# 如何将 Let's Encrypt 的 RSA 4096 位替换为 ECC 256 位？
**URL:** https://meta.discourse.org/t/how-to-replace-lets-encrypt-rsa-4096-bits-with-ecc-256-bits/93901
**Category:** Support
**Created:** [2018年八月4日 06:17 UTC](https://meta.discourse.org/t/how-to-replace-lets-encrypt-rsa-4096-bits-with-ecc-256-bits/93901 "2018-08-04T06:17:34Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@RoldanLT](https://meta.discourse.org/u/RoldanLT)
#### Post date: [2018年八月4日 06:17 UTC](https://meta.discourse.org/t/how-to-replace-lets-encrypt-rsa-4096-bits-with-ecc-256-bits/93901/1 "2018-08-04T06:17:34Z")
如何将 Discourse 的 LetsEncrypt 证书从 **RSA 4096** 位替换为 **ECC 256** 位？
> **[ECDSA: The digital signature algorithm of a better internet](https://blog.cloudflare.com/ecdsa-the-digital-signature-algorithm-of-a-better-internet/)**
>
> This blog post is dedicated to the memory of Dr. Scott Vanstone, popularizer of elliptic curve cryptography and inventor of the ECDSA algorithm. He passed away on March 2, 2014.
我希望在我的安装中永久启用此设置，即使在 Discourse 升级后也能保持，这是否可行？
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2018年八月6日 00:36 UTC](https://meta.discourse.org/t/how-to-replace-lets-encrypt-rsa-4096-bits-with-ecc-256-bits/93901/2 "2018-08-06T00:36:40Z")
@mpalmer does this request make sense to you? Is there anything off with our current certificate config in NGINX?
OK per [https://www.ssl247.com/kb/ssl-certificates/generalinformation/what-is-rsa-dsa-ecc](https://www.ssl247.com/kb/ssl-certificates/generalinformation/what-is-rsa-dsa-ecc) ECC is latest and greatest, so I guess we should at least document how to do this. Not sure.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [2018年八月6日 00:57 UTC](https://meta.discourse.org/t/how-to-replace-lets-encrypt-rsa-4096-bits-with-ecc-256-bits/93901/3 "2018-08-06T00:57:29Z")
I’m ambivalent on documenting it. The benefits of wholesale replacing an RSA certificate with an ECC one are so niche, and the potential downsides so great, that we’d probably end up with more “I did this thing without considering the consequences AND IT’S ALL YOUR FAULT” topics than “I have a legitimate use case for an ECC cert but can’t figure out how to modify the template to make it happen”.
---
### Author:  [@schleifer](https://meta.discourse.org/u/schleifer)
#### Post date: [2018年八月6日 17:38 UTC](https://meta.discourse.org/t/how-to-replace-lets-encrypt-rsa-4096-bits-with-ecc-256-bits/93901/6 "2018-08-06T17:38:18Z")
> [@mpalmer](#):
>
> I have a legitimate use case for an ECC cert but can’t figure out how to modify the template to make it happen
That’s an empty set. I’d bet on it. 🍻
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2018年八月6日 21:46 UTC](https://meta.discourse.org/t/how-to-replace-lets-encrypt-rsa-4096-bits-with-ecc-256-bits/93901/7 "2018-08-06T21:46:05Z")
> [@RoldanLT](#):
>
> At least maybe give us an option
It is an option you just have to figure out how to write the template and mix it in
---
### Author:  [@RoldanLT](https://meta.discourse.org/u/RoldanLT)
#### Post date: [2018年八月7日 18:25 UTC](https://meta.discourse.org/t/how-to-replace-lets-encrypt-rsa-4096-bits-with-ecc-256-bits/93901/11 "2018-08-07T18:25:52Z")
只编辑该文件的第 59 行和第 63 行就够了吗？
然后重新构建 Discourse？
>
编辑 /templates/web.letsencrypt.ssl.template.yml 的第 59 行和第 63 行并未生效。
我的代码：
如果我强制更新/生成新证书，也许能行？
Discourse 下的命令是什么？
谢谢！
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [2021年三月11日 01:16 UTC](https://meta.discourse.org/t/how-to-replace-lets-encrypt-rsa-4096-bits-with-ecc-256-bits/93901/12 "2021-03-11T01:16:35Z")
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [2021年三月11日 01:59 UTC](https://meta.discourse.org/t/how-to-replace-lets-encrypt-rsa-4096-bits-with-ecc-256-bits/93901/13 "2021-03-11T01:59:58Z")
@gerhard 于 2019 年实现了这一功能
>
>
> \[Mozilla\](https://wiki.mozilla.org/Security/Server\_Side\_TLS) recommends ECDSA (P…-256) as certificate type for intermediate compatibility.
>
> \> ECDSA certificates are recommended over RSA certificates, as they allow the use of ECDHE with Windows 7 clients using Internet Explorer 11
>
> Most modern browsers will use cipher suites with the ECDSA certificate. Older browsers will select the RSA certificate and a RSA cipher suite.
>
> It will create two Let's Encrypt certificates:
> \* EC 256 bits (SHA256withRSA)
> \* RSA 4096 bits (SHA256withRSA)
>
> Without this change all the ECDSA cipher suites defined in https://github.com/discourse/discourse\_docker/blob/12f501764f57c827e497eb6fb88e98f8c3c468e6/templates/web.ssl.template.yml#L22 won't work. With the new certificate all cipher suites will work and browsers like IE11 on Windows 7 and Windows 8 will work too.
>
> \*\*Before:\*\*
> !\[\](https://user-images.githubusercontent.com/473736/64466317-a8e8f780-d111-11e9-84f1-f7b1dc75e523.png)
>
> \*\*After:\*\*
> !\[\](https://user-images.githubusercontent.com/473736/64466321-ad151500-d111-11e9-92bf-7c50ef2cd6b1.png)
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [2021年三月11日 02:00 UTC](https://meta.discourse.org/t/how-to-replace-lets-encrypt-rsa-4096-bits-with-ecc-256-bits/93901/14 "2021-03-11T02:00:29Z")