I have a server that when installed automatically created a Let's Encrypt cert. The cert is 2048 but for testing I need to rekey it to 1024. I don't see any rekeying procedures anywhere or at least any documentation explaining a workaround.

Unfortunately, you won't be able to get a Let's Encrypt certificate of that size. The minimum supported key length for RSA certificates is 2048.

Thanks for the info. Since we have hundreds of devices that can’t negotiate SSL connections with certs larger than 1024 we’ll have to get our certs elsewhere.

You will likely have to spin up your own internal certificate authority in order to generate certs with 1024 bit keys. I don't think any publicly trusted certificate authority is allowed to issue certificates with key sizes that small anymore unless I'm misunderstanding the baseline requirements. T…

Most likely a futile question / obvious answer ... but I have to ask it: Do those device support any other type of certs, like: ECDSA/ECC ? READERS: Get involved and participate: If you read something you like, then click to like it :heart:

[image] rmbolger: Ensure that the modulus size, in bits, is evenly divisible by 8. Although many sizes may be allowed, I think this is no longer being supported by LE. See: Issuing for common RSA key sizes only

[image] slonkak: The cert is 2048 but for testing I need to rekey it to 1024. From the numbers we implicitly assumed (of course, with extreme high likelihood) that you are talking about RSA keys here. For the shake of precision could you confirm this, please? Just out of curiosity, what kind…

There was kind of a big fight about some of the rules that @rmbolger mentions because they were part of an important security update for the Internet, but many people had older devices that weren't compatible with them (if I remember correctly, mostly retail point-of-sale systems, but probably other…

[image] bruncsak: Just out of curiosity, what kind of device is it, which does not allow bigger than 1024 bits of RSA key to use? The server is a voip server and the devices are old Cisco SPA303's. I've found various posts on the Cisco forums and other sites with people doing crypto dev and …

[image] slonkak: they found that the 303's can only do DH negotiation at 1024 How about any ciphers that don't use DH?

[image] slonkak: Cisco phones only trust certs from the Cisco CA Do you have a Cisco CA? If so, what are the cipher options available there? [image] slonkak: which was what I have to do for them to trust LE certs If you can get them to trust another CA, then you could create your own…

Rekeying a certificate?

Help

rg305 October 29, 2020, 12:36am 6

Although many sizes may be allowed, I think this is no longer being supported by LE.

See: Issuing for common RSA key sizes only

Topic		Replies	Views
How to replace cert with a stronger one Help	6	393	January 14, 2024
RSA keysize limited fo 4096 with certbot for any reason? Client dev	1	1754	July 19, 2018
Auto renewing via cron job only issuing 2048 key size Help	10	10324	October 20, 2017
Needless fact about RSA private key sizes Issuance Tech	10	7901	November 5, 2019
Support for >4096 bit keys Feature Requests	17	13441	March 12, 2018

Rekeying a certificate?

Related topics