Elliptic Curve Cryptography (ECC) Support

The hash in a CSR is just for validating said CSR… Your CSR generation software just hashes (some parts of) the CSR and signs it with your own private key, which can be validated with the public key in the same CSR: ergo, validating “itself”. It has nothing to do with the final issued certificate what so ever as far as I know :slight_smile: Boulder just checks your CSR for validity with it and consequentely takes some of the info from it… CN… SAN… Other extensions… But it doesn’t use the used hash algo. The cert algo is hardcoded into Boulder at this moment:

https://github.com/letsencrypt/boulder/blob/master/ca/certificate-authority.go#L176

2 Likes