Lets Encrypt ECDSA certificate request for new accounts

Issuance Tech
1

Hello there,

I am a consumer of Lets Encrypt certs generated by cert-manager. We have currently 10 clusters that is running the certs. For each cluster its a new account. I wanted to move to ECDSA certs instead of RSA. I found out that I need to fill out a form to add to allowlist from the accounts that need ECDSA certs. I can do for the existing environments

Is it possible to add to the whitelist based on the domains instead of the accounts? because if we create new environments, then we need to wait till the account is added ot allowlist to get the certs issued. If its not possible can you suggest some alternatives, thats possible other than deploy new environment, get new account, request account to add in allowlist and wait for it?

Best Regards,
Allan John

1 Like
2

Do you need a complete ECDSA chain [and root]?
OR just an ECDSA cert?
[two very different requests]

4 Likes
3

Thanks for replying fast. I need ECDSA chain.

1 Like
4

OK.
Do you need to use a separate LE account for each cluster?

4 Likes
5

It's not unfortunately. And I don't think Let's Encrypt will add this option, as I believe Let's Encrypt is working towards making the ECDSA-only chain the default for all ECDSA end leaf certificates (although I'm not familiar with an exact time table).

1 Like
6

Thanks for the response and I am glad to know that Let's Encrypt is working to make this feature possible.

1 Like
7

What feature? The allowlist was always meant as a temporary method, until ISRG Root X2 is wildely trusted.

2 Likes
8
3 Likes
9

Any idea like a timeline when this can be expected?

10

Where "exact" also means "rough" to be honest.

11

we have many services running, so I believe with one account, we might hit the limit with number of certificates that can be issued? I understand its 100. Please correct me if I am wrong

12

Please see Rate Limits - Let's Encrypt

The real relevant rate limit with regard to accounts here is:

You can create a maximum of 300 New Orders per account per 3 hours.

So if you require more than 300 certificates per 3 hours continuously, then yes, you need more accounts. But I highly doubt that.

2 Likes
13

Are you sure you're not mixing up two different things? Anyone can request ECDSA certificates, and it's indeed the default now for popular clients (certbot, acme.sh, others).

By default those ECDSA certificates will be issued by an RSA intermediate (R3), but that should not make any functional difference for your server nor your clients (wrt. choice of ciphers, handshake performance, etc, that all depends exclusively on the leaf certificate type). Only if you want your ECDSA certificates to be issued by an ECDSA intermediate (E1), you can currently request this on account basis via the allowlist, until this becomes the default on LE side.

6 Likes
14

So I can use a single account to request certificates for multiple domain names?

15

Sure, no problem at all.

5 Likes
16

We have a requirement from our Security team, that we need to have our full chain certs in ECDSA. I understand the ECDSA chain can be possible with allowlist. So I wanted to know when will ECDSA be by default, so I can plan accordingly what changes to make

1 Like
17

I'd like to hear their reasons.

6 Likes
18

We will likely have general availability of ECDSA chains on our next set of intermediates in Q1 or Q2 of 2024. No guarantee of schedule, but we don’t want to have to maintain a list either.

11 Likes
19

Yes. You should probably also fill out a ratelimit request form too and note that you are consolidating many accounts and services under one account to get the full ECDSA chain to E1.

3 Likes
20

I think full ecdsa deployment will come when LE finally retire DST root x3 long chain, so it doesn't have super long chain

4 Likes