3 ms·

Do I understand correctly that this event also means that ssl.com is the first CA to offer free ECC certificates to the general public?

tialaramex 5y ago
Let's Encrypt will issue you with "ECC certificates" depending on what your idea of an "ECC certificate" is. For a generic Let's Encrypt site if you have Elliptic curve keys, the existing R3 issuing intermediate will cheerfully sign you a certificate. The certificate will be for your EC public key, but signed by the R3 intermediate using RSA. If your reason for wanting EC is that it's less work on your server, this achieves the goal, no RSA signatures from your servers (unless you also need to serve customers that can only do RSA and need a separate setup for that). If you want, you can enroll in a trial programme for Let's Encrypt EC issuing intermediates where E1 will sign your EC keys (if you enroll R3 still signs any RSA keys you ask for). This chains through ISRG Root X2 and then ISRG Root X1 because ISRG Root X2 is not trusted by most (any?) large trust stores today. If you can't have RSA anywhere in the chain then yeah, Let's Encrypt can't do that for you in practice today, although it'd be nice if you explain why you'd want that.
Scott_Helme_ 5y ago
Let's Encrypt can issue from an ECC chain, I've tweeted[1] the details on how to enable your account for that. [1] https://twitter.com/Scott_Helme/status/1392101598852222976 https://twitter.com/Scott_Helme/status/1392101598852222976
- nextgens 5y ago
  What's the shortest chain-size that those free CAs can offer (assuming android>=5.0 devices)? It would be great to have a tool somewhere that matches client handshakes & supported CAs vs server config & choice of CA chains
  - Scott_Helme_ 5y ago
    They're all 3 certificates long (leaf/intermediate/root) apart from Let's Encrypt which, due to their cross-signature, are 4 certificates long for ECC.

tialaramex 5y ago

Let's Encrypt will issue you with "ECC certificates" depending on what your idea of an "ECC certificate" is. For a generic Let's Encrypt site if you have Elliptic curve keys, the existing R3 issuing intermediate will cheerfully sign you a certificate. The certificate will be for your EC public key, but signed by the R3 intermediate using RSA. If your reason for wanting EC is that it's less work on your server, this achieves the goal, no RSA signatures from your servers (unless you also need to serve customers that can only do RSA and need a separate setup for that). If you want, you can enroll in a trial programme for Let's Encrypt EC issuing intermediates where E1 will sign your EC keys (if you enroll R3 still signs any RSA keys you ask for). This chains through ISRG Root X2 and then ISRG Root X1 because ISRG Root X2 is not trusted by most (any?) large trust stores today. If you can't have RSA anywhere in the chain then yeah, Let's Encrypt can't do that for you in practice today, although it'd be nice if you explain why you'd want that.

Scott_Helme_ 5y ago

Let's Encrypt can issue from an ECC chain, I've tweeted[1] the details on how to enable your account for that. [1] https://twitter.com/Scott_Helme/status/1392101598852222976 https://twitter.com/Scott_Helme/status/1392101598852222976

nextgens 5y ago
What's the shortest chain-size that those free CAs can offer (assuming android>=5.0 devices)? It would be great to have a tool somewhere that matches client handshakes & supported CAs vs server config & choice of CA chains
- Scott_Helme_ 5y ago
  They're all 3 certificates long (leaf/intermediate/root) apart from Let's Encrypt which, due to their cross-signature, are 4 certificates long for ECC.