How to replace Discourse LetsEncrypt Certificate from RSA 4096 bits to ECC 256 bits?
I want this permanent on my install, even after upgrade of discourse, is that possible?
AI-generated summary
The discussion revolves around replacing the default Let’s Encrypt RSA 4096 bits certificate with an ECC 256 bits certificate in Discourse. RoldanLT initiated the conversation, seeking a permanent solution that would survive upgrades. sam asked mpalmer for input, to which mpalmer responded that documenting the process might not be beneficial due to potential downsides.
RoldanLT attempted to modify the web.letsencrypt.ssl.template.yml file by editing lines 59 and 63 but was unsuccessful. Falco pointed out that gerhard implemented ECC support in 2019, which might be relevant to the issue.
@mpalmer does this request make sense to you? Is there anything off with our current certificate config in NGINX?
OK per https://www.ssl247.com/kb/ssl-certificates/generalinformation/what-is-rsa-dsa-ecc ECC is latest and greatest, so I guess we should at least document how to do this. Not sure.
I’m ambivalent on documenting it. The benefits of wholesale replacing an RSA certificate with an ECC one are so niche, and the potential downsides so great, that we’d probably end up with more “I did this thing without considering the consequences AND IT’S ALL YOUR FAULT” topics than “I have a legitimate use case for an ECC cert but can’t figure out how to modify the template to make it happen”.
That’s an empty set. I’d bet on it. 
It is an option you just have to figure out how to write the template and mix it in
@gerhard implemented this back in 2019