I'm trying to obtain an EC-based X509 certificate using secp256 from Let's Encrypt. Let's Encrypt is returning an error instead of issuing the certificate:

$ letsencrypt --manual --csr ~/cryptopp-com.req.pem.ec auth

Press Enter to Continue
Waiting for verification...
Cleaning up challenges
An unexpected error occurred:
The request message was malformed :: Error parsing certificate request: x509: unsupported elliptic curve

The certificate signing request looks well formed to me (see below). Both secp256k1 and ecdsa are well known names (though I have seen secp256k1 referred to by its ansi name prime256v1 at times). secp256k1 is also the most popular curve used on the Internet.

The same process works when using RSA keys, so I don't believe the problem is with the process.

What curve name should I be using in the request?

# openssl req -in cryptopp-com.req.pem.ec -text -noout
Certificate Request:
        Version: 0 (0x0)
        Subject: O=Crypto++ Project/emailAddress=webmaster@cryptopp.com
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                ASN1 OID: secp256k1
        Requested Extensions:
            X509v3 Subject Key Identifier:
            X509v3 Subject Alternative Name:
                DNS:cryptopp.com, DNS:www.cryptopp.com
            Netscape Comment:
                OpenSSL generated CSR
    Signature Algorithm: ecdsa-with-SHA256
  • Well this is surprising... Let's Encrypt does not support EC-based certificates. Also see Upcoming Features | ECDSA Root and Intermediates – user40589 Dec 22 '18 at 23:01
  • 1
    " Let's Encrypt does not support EC-based certificates." This is not true. It does not support EC based certificates signed by an EC CA certificate, which is the point that should change in Q1 2019. But they do support providing EC certificates signed by their RSA CA certificate. – Patrick Mevzek Dec 27 '18 at 15:09

Per https://letsencrypt.org/docs/integration-guide/ :

Let’s Encrypt accepts RSA keys from 2048 to 4096 bits in length, and P-256 and P-384 ECDSA keys. That’s true for both account keys and certificate keys. You can’t reuse an account key as a certificate key.

So you can have EC-based certificates, but note that they will for now still be signed by a RSA-based CA certificate, which is something that should change in 2019.

On https://thecustomizewindows.com/2016/11/how-to-generate-lets-encrypt-ecc-ssl-ecdsa-certificate/ you can see an example using key algorithm named secp384r1

And as you can see on https://scotthelme.co.uk/ecdsa-certificates/ the other key algorithm you can use is secp256r1.

You say you did use secp256k1, this is another curve. See https://crypto.stackexchange.com/questions/18965/is-secp256r1-more-secure-than-secp256k1 which says in summary:

The main difference is that secp256k1 is a Koblitz curve, while secp256r1 is not. Koblitz curves are known to be a few bits weaker than other curves

(secp256r1 is a random curve not a specific Koblitz one, hence the difference in name between r and k)

  • Thanks Patrick. I'm going to hold off on testing until the entire chain is EC-based. I recall not too long ago clients had problems with Comodo certs that used different signing algorithms when path building. I guess the IETF's PKIX (or maybe the CA/B Forum) changed their issuing policies, and allow mixing RSA and ECDSA. – user40589 Dec 31 '18 at 23:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy