OpenSSL clearly already supports the generate of Ed25519 private keys and derived certificates. But the Certbot robot does not support the signing of such certificates by widely respected Certificate Authorities. ( Can/should ISRG submit a proposal to support Ed25519/Ed448 certificates to CA/B Forum…

[image] Nekit: What's the stance of CA/B forum on such certificates? That's exactly it; see this thread: Support Ed25519 and Ed448

What's the stance of CA/B forum on such certificates?

[image] anonymous1: the signing of Ed25519 certificates by trustworthy Certificate Authority Do you know of any CA already issuing Ed25519 certificates? It's not like that if certbot would support it, suddenly CAs will issue certs with Ed25519. Also, I'm not sure if this Community is the rig…

I don't think anyone can realistically expect LetsEncrypt/Certbot to support the CA/B forum adopting this standard out of the blue. Perhaps someone would be interested in coding a Certbot/Pebble POC? I'm certainly not :wink: – but I do think there is probably someone passionate about this, and if …

[image] jvanasco: Perhaps someone would be interested in coding a Certbot/Pebble POC? I'm certainly not :wink: Pebble doesn't care about the contents of the private key, I checked. No code checking RSA/ECDSA/EdDSA what so ever :smiley: For certbot on the other hand: different story. I tried …

looks like ed25519 defined to use SHA-512 as hash function , try send it as parameter anyway?

Assuming you have your own ACME enabled Certificate Authority you could perhaps use your own CSR with --csr in certonly mode. As far as I know there are no web browsers(?) which would be able to consume an Ed25519 certificate, if that's relevant to your use case.

[image] orangepizza: looks like ed25519 defined to use SHA-512 as hash function , try send it as parameter anyway? That didn't work, but the following did work: diff --git a/certbot/certbot/_internal/cli/__init__.py b/certbot/certbot/_internal/cli/__init__.py index 4212c353b..38f9674a4 10064…

For anyone interested. I've incorporated part of above code and augmented it so it doesn't require a patched OpenSSL (Python) library! You can find a certbot version supporting Ed25518 as wel as Ed448 here: GitHub - osirisinferi/certbot at add-eddsa-support add-eddsa-support Fork of…

Very cool! Apache and OpenSSL (and curl, at least when compiled against OpenSSL) support EdDSA: osiris@erazer ~ $ openssl s_client -CAfile /tmp/root.pem -connect example.com:443 CONNECTED(00000003) depth=2 CN = Pebble Root CA 7520ca verify return:1 depth=1 CN = Pebble Intermediate CA 529b41 verify …

[image] Osiris: Unfortunately Go does not support Ed448 (see proposal: x/crypto: add implementation of Diffie-Hellman x448 · Issue #29390 · golang/go · GitHub for their arguments), so I believe SmallStep does not support Ed448 (but it does support EdDSA, probably Ed25519 only) I can confirm t…

Request For CertBot To Support The Signing of Ed25519 Certificates

Feature Requests

JamesLE August 12, 2021, 10:18pm 4

That's exactly it; see this thread: Support Ed25519 and Ed448

Topic		Replies	Views
Can/should ISRG submit a proposal to support Ed25519/Ed448 certificates to CA/B Forum? ISRG/Organizational	13	5655	October 4, 2019
Support Ed25519 and Ed448 Feature Requests	8	10189	January 15, 2019
Elliptic Curve Cryptography (ECC) Support Feature Requests	198	63924	April 21, 2016
TLS 1.2 and TLS 1.3 need Curve25519 and Curve448 SSL certificates Issuance Policy	13	7009	June 27, 2023
Ed25519 CSR -- bug or an unimplemented feature? Feature Requests	5	2140	April 2, 2019

Request For CertBot To Support The Signing of Ed25519 Certificates

Related topics