Should we be defaulting to ECC keys now?

I think most people, who don't know what kind of key type to use, will be fine if the default is ECDSA, since that will work for most normal user-facing web sites.

The tricky bit is that if they do need to integrate with some old system that doesn't know what ECDSA is, they're likely to get a vague, confusing error message like "Server error", or their incompetent hosting provider will just say "the cert is invalid", which doesn't really give them an indication that they need to check the RSA box in their ACME client configuration in order for their system to work.

I think it's definitely still worth ECDSA being the default, though. While there have been a few times on the forum since certbot 2 switched to ECDSA by default that we've needed to direct people to just add --key-type RSA to their certbot command, compared the number of new certs being added out there it's a really small percentage.

For as close to an "official" recommendation as I think there is, the Mozilla Guidelines recommend ECDSA for not just "Modern" (TLS 1.3 only) sites, but also for "Intermediate" compatibility. That's for web sites, though, and people using TLS for other applications like email servers really still need to have an RSA cert (even if it's in parallel with an ECDSA cert) to deal with all the random old email servers out there.

8 Likes