My app only accepts SHA1WithRSAEncryption, SHA256WithRSAEncryption, and SHA512WithRSAEncryption.
The problem I'm facing is that my certificate is using SHA381WithRSAEncryption when I specify the "--key-type rsa" option in the command below.
If I don't specify this option, it generates a certificate with SHA256WITHECDSA.
How can I ensure that I have a SHA256WITHRSA signature? Thank you.
Well, if you're using Sectigo then you're probably better off contacting them for support. But the signature type is based on the CA's intermediate that they're signing your certificate with and how they do the signing. It sounds like if you use an RSA key, they're using SHA384WithRSAEncryption (I'm assuming that's what you meant rather than SHA381), and if you're using an ECDSA key (which is Certbot's default) that they're using an ESCDA intermediate by using SHA256WITHECDSA. You'd have to contact Sectigo to see if they have any options to sign your certificates with a different intermediate or a different signature method.
But, it really sounds to me like you're asking the wrong question. What kind of crazy app would support an ECDSA key but not if signed using SHA256WITHECDSA? None of the signature algorithms being used here are weird. I could see some really old stuff not supporting ECDSA at all, but something that supports both SHA-256 and SHA-512 signatures of RSA I would really expect could also support SHA-384, unless this is a common issue of some old library that I'm not familiar with.
Yes, I already contact the support, I can wait but I want to know if I'm missing something.
It work with the default algorithm (SHA384) for like 10 years but not anymore due to an update (on their side).
The app is probably older than me ..
Here's the error of my app when I try to submit SHA384 or SHA256WITHEDCSA certificate:
The Certificate Authority (CA) - in your case apparently Sectigo - chooses the signature algorithm. The hash algorithm used commonly scales with key size (though this isn't always the case). SHA-256 is often used with 2048-bit RSA keys and SHA-384 is sometimes used with 3072 bit RSA keys.
It is possible that Sectigo has started issuing using a 3072 bit RSA issuer (while they probably were using SHA-256/2048 bit RSA before), which has lead to the change in signature algorithm. However, since you haven't provided any domain name or certificate chain we cannot verify this (we're also not Sectigo support ).
Thank you for your response @Nummer378
I understand that you are not the support team for Sectigo. I just wanted to make sure I wasn't overlooking any configuration or command issues on my part. However, you have clarified my doubts.
Sectigo has always issued certificates in RSA/SHA384.
It is the specific application that, since its update, has been displaying the error message (see the screenshot above).
I just have to wait an answer from Sectigo support I guess ...
So it's a really old app, but still getting updates, and these updates remove allowed signature algorithms? I mean, I don't know this app at all, but that sounds… really weird to me.
Sectigo send me a correct certificate (in SHA256WithRSAEncryption) and the app accept it immediatly.
So yeah, thank you for your time and have a great day !
).
and have a great day !