如何将 Let's Encrypt 的 RSA 4096 位替换为 ECC 256 位？

Falco · 2021 年3 月 11 日 01:59

@gerhard 于 2019 年实现了这一功能

github.com/discourse/discourse_docker

FEATURE: Elliptic Curve certificate (#444)

master ← elliptic_curve

merged 11:02PM - 09 Sep 19 UTC

gschlager

+50 -14

[Mozilla](https://wiki.mozilla.org/Security/Server_Side_TLS) recommends ECDSA (P…-256) as certificate type for intermediate compatibility. > ECDSA certificates are recommended over RSA certificates, as they allow the use of ECDHE with Windows 7 clients using Internet Explorer 11 Most modern browsers will use cipher suites with the ECDSA certificate. Older browsers will select the RSA certificate and a RSA cipher suite. It will create two Let's Encrypt certificates: * EC 256 bits (SHA256withRSA) * RSA 4096 bits (SHA256withRSA) Without this change all the ECDSA cipher suites defined in https://github.com/discourse/discourse_docker/blob/12f501764f57c827e497eb6fb88e98f8c3c468e6/templates/web.ssl.template.yml#L22 won't work. With the new certificate all cipher suites will work and browsers like IE11 on Windows 7 and Windows 8 will work too. **Before:** ![](https://user-images.githubusercontent.com/473736/64466317-a8e8f780-d111-11e9-84f1-f7b1dc75e523.png) **After:** ![](https://user-images.githubusercontent.com/473736/64466321-ad151500-d111-11e9-92bf-7c50ef2cd6b1.png)

话题		回复	浏览量
Improvements to web.letsencrypt.ssl.template.yml Development docker , letsencrypt	0	107	2024 年9 月 25 日
Help with SSL/HTTPS with Discourse Installation Support	3	358	2025 年4 月 3 日
Hit Let's encrypt renewal limit Self-hosting	6	2306	2020 年7 月 1 日
Let's Encrypte with multiple domains wasn't working for ECC certs Self-hosting	24	807	2024 年10 月 5 日
LetsEncrypt DNS Validation Template Using Cloudflare Self-hosting letsencrypt	1	368	2024 年10 月 17 日

如何将 Let's Encrypt 的 RSA 4096 位替换为 ECC 256 位？

相关话题