3 ms·
This question is on my wavelength. Getting an all-ECC chain EV cert that is published to the CT logs is dang near impossible. I spent a couple of months of bac
by gorkish 6y ago
This question is on my wavelength.
Getting an all-ECC chain EV cert that is published to the CT logs is dang near impossible. I spent a couple of months of back and forth with DigiCert over the last 2.5 years or so trying to get one, but they were never able to issue one despite trying and having the correct roots and intermediates in place to do this. I feel this is one of those situations where their software simply couldn't handle this edge case, and I was not important enough to escalate to a manual process.
The benefit to an all ECC chain (including an ECC root) is not just size. There is a some small amount of time and energy especially on mobile devices on first load when validating ECC signatures compared to RSA 4096 signatures of the intermediate and client cert (the signatures are bigger too). Granted, it is cached after that, but collectively if I have 10 million sessions per month that's real time and energy wasted.