ECDSA testing on staging

62

How do I properly generate an ec csr for LE? Please excuse the newb question.

I though I had it using the prime256v1 curve but when I try to generate a cert against staging I receive an invalid signature algorithm error.

63

Did you use the SHA256 hash? Some OpenSSL configs default to SHA1.

64

That was it. thank you.

65

This is still staging only correct or can I do this on production? If not, whatā€™s the eta? Iā€™m just curious. Iā€™m in no rush whatsoever.

66

Hello @Fsantiago1979,

Since 10 Feb is in production too:

Cheers,
sahsanu

1 Like
67

Still no secp521r1 support. Iā€™m still waiting on this so I donā€™t have to self-sign my certificates anymore

2 Likes
68

me too.
I mean p521 is the equivalent of essentially 256bit symmetric and essetially 15k+ RSA, giving it a lot more strength against Mooreā€™s law than p256 or p384

1 Like
69

Chicken vs. egg story I thinkā€¦

As far as I know, lack of browser support was the reason for not supporting secp521r1. But browsers wonā€™t have a reason for supporting it, if CAā€™s wonā€™t issue them anyway.

2 Likes
70

Shouldnā€™t we just wait for the new curves 25519 and 448 instead of hoping for support for older NIST curves?

71

@ecdsa-chacha20 why not both?

2 Likes
72

cerbot-auto can generate a SSL with ECDSA now?

73

AFAIK that's not quite right. Chrome uses BoringSSL for TLS. Only the certificate validation is handled by the OS.

74

If I remember correctly, you can use ECDSA keys using the --csr flag, but not in any mode where certbot generates the certificate for you.

1 Like
75

well but then it is an intresting question on why chrome doesnt do TLS1.2 on XP like firefox does
https://productforums.google.com/forum/#!topic/chrome/iZsc8ZG5hWk
I know that chrome now isnt supported but back at the time of this post it was still supported because in the announcement linked in the post it said that chrome wont do XP and longer starting from april 2016.
itā€™s also sad that they dont do EC certs (but which seems legit when the OS does the cert handling.
in my opinion it would have been better if they just did their stuff completely like forefox does.

dont get me wrong I think that right now XP isnt really a machine which should be connected to the internet because it has been dropped for over 2 years and a lot of their security is pretty bad by todayā€™s standards.

But there are people who have no choice of using XP, especially in poorer countries.
and then the only major browser that can help them to do at least a bit of TLS security is Firefox.

2 Likes