Hello, while I love let’s encrypt philosophically I haven’t used it before for three reasons: A) Normally I prefer ecdsa certs and it seems let’s encrypt doesn’t do that (yet) B) I don’t like the idea of an automatic script that connects to external resources modifying a daemon configuration. C) …

acmetool is one substitute for Certbot that can do EC certificate private keys, supports certificate private key re-use, and will not alter your server configuration. Based on your expressed views (which I share) I believe that changing clients may be the best way for you to go.

[image] AliceWonderMiscreati: A) Normally I prefer ecdsa certs and it seems let’s encrypt doesn’t do that (yet) Let's Encrypt can issue ECDSA (P-256 or P-384) certificates, but the current intermediates and roots are RSA. ECDSA intermediates and roots are on the to-do list. [image] AliceW…

If there’s an option to specify the CSR to use I’m golden - that’s what I already do with commercial CAs - I have shell script that generates the private key and the CSR. So for Let’s Encrypt with certbot I can probably just do the same thing but then manually run certbot to fetch the new cert ever…

[image] AliceWonderMiscreati: If there’s an option to specify the CSR to use I’m golden - that’s what I already do with commercial CAs - I have shell script that generates the private key and the CSR. So for Let’s Encrypt with certbot I can probably just do the same thing but then manually run …

Some more information on this topic in a recent thread: [image] How to recreate let's encrypt certificate with public key from the past? Help S…

I’ve been successful issuing RSA and ECC certs with specified private.key and CSR using LE64

No they weren’t, but the point is that there can be bugs that allow cracking a key to take less than time required for brute force. Going a little larger than minimum may help in those cases. Or going ECDSA, which from another reply looks like might be possible now, and is nicer to lower power devic…

[image] AliceWonderMiscreati: Reading up on the certbot now, it seems the CSR option either isn’t documented or the certbot in EPEL doesn’t have it because certbot -h doesn’t show it. It should be shown when certain options are passed, like "certbot -h certonly" or "certbot -h all".

Okay everything with my script seemed to work, but this interesting note: IMPORTANT NOTES: Congratulations! Your certificate and chain have been saved at: /home/alice/0001_chain.pem Your cert will expire on 2018-07-22. To obtain a new or tweaked version of this certificate in the future, simpl…

This gist has the script I used, except I used actual country / state / city / e-mail when generating CSR. https://gist.github.com/AliceWonderMiscreations/de1a37b41df545eba3b6d6e77f6f29fb letsencrypt.sh #!/bin/bash # RSA 3072-bit OPENSSL="/usr/bin/libressl" CERTBOT="/usr/bin/certbot" if …

Use existing private key?

Server

schoen April 23, 2018, 2:27am 6

Some more information on this topic in a recent thread:

Topic		Replies	Views
How to use existing private key with certbot? Help	8	8024	June 15, 2016
Certbot using csr and private key Apache and Postfix/Dovecot Server	9	5062	September 12, 2016
Letsencrypt client command to use existing private key? Issuance Tech	2	4534	September 5, 2015
How to recreate let's encrypt certificate with public key from the past? Help	13	8862	April 22, 2018
Can Let's Encrypt generate Certs for custom CSR Help	2	270	March 5, 2025

Use existing private key?

Related topics