I'm trying to obtain an EC-based X509 certificate using secp256 from Let's Encrypt. Let's Encrypt is returning an error instead of issuing the certificate:
$ letsencrypt --manual --csr ~/cryptopp-com.req.pem.ec auth ... Press Enter to Continue Waiting for verification... Cleaning up challenges An unexpected error occurred: The request message was malformed :: Error parsing certificate request: x509: unsupported elliptic curve
The certificate signing request looks well formed to me (see below). Both secp256k1 and ecdsa are well known names (though I have seen secp256k1 referred to by its ansi name prime256v1 at times). secp256k1 is also the most popular curve used on the Internet.
The same process works when using RSA keys, so I don't believe the problem is with the process.
What curve name should I be using in the request?
# openssl req -in cryptopp-com.req.pem.ec -text -noout Certificate Request: Data: Version: 0 (0x0) Subject: O=Crypto++ Project/emailAddressemail@example.com Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (256 bit) pub: 04:22:61:22:38:d9:d4:05:a4:48:e6:42:c4:a8:2e: 9d:f0:59:4d:7c:4b:90:c0:20:d1:12:ec:57:21:47: 5f:30:dc:e5:c5:f7:c9:0f:a5:88:7b:bc:a1:1f:46: 33:7b:3c:21:b8:f9:11:42:9b:08:39:0d:e1:d1:bf: f0:6e:66:4c:fb ASN1 OID: secp256k1 Attributes: Requested Extensions: X509v3 Subject Key Identifier: A4:DC:43:6C:A8:7C:1C:98:34:9F:AE:BC:8B:F3:C7:47:4E:AE:8C:B4 X509v3 Subject Alternative Name: DNS:cryptopp.com, DNS:www.cryptopp.com Netscape Comment: OpenSSL generated CSR Signature Algorithm: ecdsa-with-SHA256 30:45:02:21:00:a7:ef:46:7d:ce:16:60:30:af:63:43:83:6f: 63:02:21:58:50:c5:37:92:9e:46:d6:ac:c6:0d:57:7a:59:01: db:02:20:3c:5c:cb:36:57:11:c7:20:7a:a0:37:53:7a:da:62: 9d:3e:4e:74:71:88:e0:1c:be:e1:fa:fd:c6:69:4c:30:c8