Wie ersetze ich das Discourse-LetsEncrypt-Zertifikat von RSA 4096 Bit auf ECC 256 Bit?
Ich möchte dies dauerhaft in meiner Installation haben, auch nach einem Discourse-Upgrade. Ist das möglich?
sam
6. August 2018 um 00:36
2
@mpalmer does this request make sense to you? Is there anything off with our current certificate config in NGINX?
OK per What is RSA, DSA and ECC? ECC is latest and greatest, so I guess we should at least document how to do this. Not sure.
mpalmer
6. August 2018 um 00:57
3
I’m ambivalent on documenting it. The benefits of wholesale replacing an RSA certificate with an ECC one are so niche, and the potential downsides so great, that we’d probably end up with more “I did this thing without considering the consequences AND IT’S ALL YOUR FAULT” topics than “I have a legitimate use case for an ECC cert but can’t figure out how to modify the template to make it happen”.
schleifer
6. August 2018 um 17:38
6
That’s an empty set. I’d bet on it.
sam
6. August 2018 um 21:46
7
RoldanLT:
At least maybe give us an option
It is an option you just have to figure out how to write the template and mix it in
Reicht es, Zeile 59 und 63 in dieser Datei zu bearbeiten?
Das Bearbeiten von Zeile 59 und 63 in /templates/web.letsencrypt.ssl.template.yml hat nicht funktioniert.
Vielleicht funktioniert es, wenn ich die Erneuerung bzw. Generierung eines neuen Zertifikats erzwingen?
Falco
11. März 2021 um 01:59
13
@gerhard hat dies bereits 2019 umgesetzt
master ← elliptic_curve
merged 11:02PM - 09 Sep 19 UTC
[Mozilla](https://wiki.mozilla.org/Security/Server_Side_TLS) recommends ECDSA (P… -256) as certificate type for intermediate compatibility.
> ECDSA certificates are recommended over RSA certificates, as they allow the use of ECDHE with Windows 7 clients using Internet Explorer 11
Most modern browsers will use cipher suites with the ECDSA certificate. Older browsers will select the RSA certificate and a RSA cipher suite.
It will create two Let's Encrypt certificates:
* EC 256 bits (SHA256withRSA)
* RSA 4096 bits (SHA256withRSA)
Without this change all the ECDSA cipher suites defined in https://github.com/discourse/discourse_docker/blob/12f501764f57c827e497eb6fb88e98f8c3c468e6/templates/web.ssl.template.yml#L22 won't work. With the new certificate all cipher suites will work and browsers like IE11 on Windows 7 and Windows 8 will work too.
**Before:**
**After:**
