Howto obtain ECDSA cert (in addition to RSA) with certbot?

Server
1

Hello everybody,

I’m pretty new to setting up web servers with SSL/ HTTPS and even after reading through the certbot documentation, searching this forum and using Google, I can’t figure it out myself and would need some help.
I already managed to obtain certificates encrypted with RSA, but after reading about ECDSA having slight speed advantages during TLS handshake I wanted to follow the guide of @ScottHelme (https://scotthelme.co.uk/ecdsa-certificates/), but use certbot instead of acme_tiny.py.

So I ran the commands from the guide and additionally the certbot command:

  1. openssl ecparam -genkey -name secp256v1 > ecdsa.key
  2. openssl req -new -sha256 -key ecdsa.key -out ecdsa.csr (and entered fqdn when asked for)
  3. certbot certonly -d host.domain.tld --dns-digitalocean --server https://acme-v02.api.letsencrypt.org/directory --csr ecdsa.csr --cert-name host.domain.tld

The request for certificates was somewhat successful. The return message of certbot informed me that the certificate has been successfully obtained. However I was expecting that four new files were placed under
/etc/letsencrypt/archive/host.domain.tld/
as usual. Instead there were only the following files created under the currenty directory (my home directory at that point) and not in the letsencrypt directory:

0000_cert.pem
0000_chain.pem
0001_chain.pem

So my questions are:

  • How should my certbot command look like, so that the expected cert files are put into the existing /etc/letsencrypt/archive/host.domain.tld/ directory?
  • Where is my fullchain.pem which I need for the nginx web server config?
  • Am I right, that I can use my ecdsa.key as keyfile for nginx just like that: ssl_certificate_key /etc/letsencrypt/live/host.domain.tld/ecdsa.key;?
  • Something else I’m missing?

I understand that I need to extend my current nginx config after I got all the files from:
ssl_certificate /etc/letsencrypt/live/host.domain.tld/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/host.domain.tld/privkey.pem;

to:
ssl_certificate /etc/letsencrypt/live/host.domain.tld/ecdsa_fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/host.domain.tld/ecdsa_privkey.pem;
ssl_certificate /etc/letsencrypt/live/host.domain.tld/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/host.domain.tld/privkey.pem;

and that I need to have ciphers suites that use ecdsa. So right now I have:
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384';

Thank you very much for any help and pointing me into the right direction. And please excuse me if I’m asking stupid question.

2

Hi,

Since ECC is not enabled by default (aka certbot won’t generate ecc key and certificate by itself), you will need to generate csr based on the key you selected, then use --csr option to specify the csr you generated.

Thank you

1 Like
3

When you use --csr, certbot doesn’t put things in /etc/letsencrypt/ like normal, it just drops the files in the current directory.

From reading https://github.com/certbot/certbot/issues/4182 it seems that 0001_chain.pem is the equivalent of what would normally be fullchain.pem.

I’m not sure why you skipped the | openssl ec -out ecdsa.key part of the command, but if openssl was happy to accept the resulting ecdsa.key then I guess maybe nginx could too? If not you can run openssl ec -out privkey.pem < ecdsa.key and use that instead.

Personally I prefer to use acme.sh for my ECDSA certs.

2 Likes
4

Right, ECDSA is still unsupported in Certbot with automated renewal and so it’s still preferable to use a different client if you want automated renewal (which is probably a good idea!).

1 Like
5

Hello everyone,

Thank you very much for your replies!

As I understood it, with that command I would have to set a password then and remove that password afterwards again. In the guide it says:

That will read in the key and write it back out without the password. You can single command it as it turns out, thanks to @jamesspi for the tip.

openssl ecparam -genkey -name secp256r1 > ecdsa.key

That will just generate the key without the password and the need to remove it which is great if you're automating things somewhere. I've left my method above though as some other guides detail how to generate the key but not remove the password.

Therefor I skipped that and only ran the one-liner.

\

Awesome tip! And it makes totally sense, because I have 4 files in total and the 0001_chain.pem is about double the size of 0000_chain.pem like the "normal" files created by certbot.

I see. What a shame I learned to use certbot a little now and hoped I could stick with it :slight_smile:
I'll have a look at acme.sh then.

Thank you so much everybody!

6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.