In the coming months, Certbot will be switching to issuing ECDSA (secp256r1) certificates by default. This will happen in the release of Certbot 2.0. Currently, Certbot issues 2048-bit RSA certificates by default. We are announcing this change now in order to provide advance warning and to gather …

Only the default key type for new certificates is changing. If you want to keep using RSA 2048-bit certificates, you can use the CLI flags which have been available since Certbot 1.10.0: --key-type rsa --rsa-key-size 2048

ECDSA certificates by default and other upcoming changes in Certbot 2.0

Client dev

Topic		Replies	Views
Certbot support for ECDSA certificates Issuance Tech	37	6174	October 3, 2020
Questions re: Production ECDSA allow-list Issuance Tech	56	9708	October 14, 2021
ECDSA intermediate issuance Help	14	5307	May 19, 2021
Policy on Issuance Chain Changes Issuance Policy	10	421	August 13, 2024
"EC XXX bits (SHAXXXwithRSA)" versus "EC XXX bits (SHAXXXwithECDSA)"? What's the difference? Does it matter? Issuance Tech	24	6023	August 5, 2022

ECDSA certificates by default and other upcoming changes in Certbot 2.0

Related topics