Let's Encrypt の RSA 4096 ビットを ECC 256 ビットに置き換える方法

RoldanLT · 2018 年 8 月 4 日午前 6:17

Discourse の LetsEncrypt 証明書が RSA 4096 ビットから ECC 256 ビットに置き換える方法は？

Discourse のアップグレード後も、この設定をインストールに恒久的に適用することは可能でしょうか？

sam · 2018 年 8 月 6 日午前 12:36

@mpalmer does this request make sense to you? Is there anything off with our current certificate config in NGINX?

OK per What is RSA, DSA and ECC? ECC is latest and greatest, so I guess we should at least document how to do this. Not sure.

mpalmer · 2018 年 8 月 6 日午前 12:57

I’m ambivalent on documenting it. The benefits of wholesale replacing an RSA certificate with an ECC one are so niche, and the potential downsides so great, that we’d probably end up with more “I did this thing without considering the consequences AND IT’S ALL YOUR FAULT” topics than “I have a legitimate use case for an ECC cert but can’t figure out how to modify the template to make it happen”.

schleifer · 2018 年 8 月 6 日午後 5:38

That’s an empty set. I’d bet on it.

sam · 2018 年 8 月 6 日午後 9:46

It is an option you just have to figure out how to write the template and mix it in

RoldanLT · 2018 年 8 月 7 日午後 6:25

このファイルの 59 行目と 63 行目を編集するだけで十分でしょうか？
その後、Discourse を再構築すればよいですか？

github.com/discourse/discourse_docker

templates/web.letsencrypt.ssl.template.yml

master


      
                  }
                }
              }
          
          - file:
             path: /etc/runit/1.d/letsencrypt
             chmod: "+x"
             contents: |
              #!/bin/bash
              /usr/sbin/nginx -c /etc/nginx/letsencrypt.conf
          
              issue_cert() {
                LE_WORKING_DIR="${LETSENCRYPT_DIR}" $$ENV_LETSENCRYPT_DIR/acme.sh --issue $2 -d $$ENV_DISCOURSE_HOSTNAME --keylength $1 -w /var/www/discourse/public
              }
          
              cert_exists() {
                [[ "$(cd $$ENV_LETSENCRYPT_DIR/$$ENV_DISCOURSE_HOSTNAME$1 && openssl verify -CAfile ca.cer fullchain.cer | grep "OK")" ]]
              }
          
              ########################################################
              # RSA cert

/templates/web.letsencrypt.ssl.template.yml の 59 行目と 63 行目を編集しても機能しませんでした。
私のコード：

強制的に証明書の更新または新規生成を行えば機能するかもしれませんか？
Discourse でのコマンドは何でしょうか？
ありがとうございます！

Falco · 2021 年 3 月 11 日午前 1:59

@gerhard が 2019 年に実装しました

github.com/discourse/discourse_docker

FEATURE: Elliptic Curve certificate (#444)

master ← elliptic_curve

merged 11:02PM - 09 Sep 19 UTC

gschlager

+50 -14

[Mozilla](https://wiki.mozilla.org/Security/Server_Side_TLS) recommends ECDSA (P…-256) as certificate type for intermediate compatibility. > ECDSA certificates are recommended over RSA certificates, as they allow the use of ECDHE with Windows 7 clients using Internet Explorer 11 Most modern browsers will use cipher suites with the ECDSA certificate. Older browsers will select the RSA certificate and a RSA cipher suite. It will create two Let's Encrypt certificates: * EC 256 bits (SHA256withRSA) * RSA 4096 bits (SHA256withRSA) Without this change all the ECDSA cipher suites defined in https://github.com/discourse/discourse_docker/blob/12f501764f57c827e497eb6fb88e98f8c3c468e6/templates/web.ssl.template.yml#L22 won't work. With the new certificate all cipher suites will work and browsers like IE11 on Windows 7 and Windows 8 will work too. **Before:** ![](https://user-images.githubusercontent.com/473736/64466317-a8e8f780-d111-11e9-84f1-f7b1dc75e523.png) **After:** ![](https://user-images.githubusercontent.com/473736/64466321-ad151500-d111-11e9-92bf-7c50ef2cd6b1.png)

トピック		返信	表示
Improvements to web.letsencrypt.ssl.template.yml Development docker , letsencrypt	0	59	2024 年 9 月 25 日
Help with SSL/HTTPS with Discourse Installation Support	3	217	2025 年 4 月 3 日
Hit Let's encrypt renewal limit Self-hosting	7	2118	2020 年 7 月 31 日
Let's Encrypte with multiple domains wasn't working for ECC certs Self-hosting	25	406	2024 年 11 月 4 日
LetsEncrypt DNS Validation Template Using Cloudflare Self-hosting letsencrypt	1	309	2024 年 10 月 17 日

Let's Encrypt の RSA 4096 ビットを ECC 256 ビットに置き換える方法

関連トピック