Hacker News new | past | comments | ask | show | jobs | submit login

The only permissible keys are:

RSA keys of 2048 bits or some larger multiple of 8 bits or ECDSA keys from NIST P-256, NIST P-384 or NIST P-521 curves

https://cabforum.org/baseline-requirements-documents/ (See section 6.1.5)

Other keys violate the Baseline Requirements which are common rules agreed between the major CAs and Browser vendors. Now, a CA could choose to just disregard the BRs, but then they're automatically in violation of the root trust programme rules for the major root trust programmes - at least Microsoft, Apple, Mozilla, Google, then arguably Oracle (because Java) and some other smaller outfits. So that's probably the end of that Certificate Authority, at least for the Web PKI.

Individual root programmes also have their own rules, and so in this case Mozilla's rules are important because they further restrict keys to RSA or ECDSA P-256 or P-384 only.

https://www.mozilla.org/en-US/about/governance/policies/secu... (section 5.1 this time)

Now, those are just policies, you can change policies, but that's not up to Let's Encrypt. If you believe Mozilla needs to support Curve 25519 then that's a bunch of software development you can volunteer to do, followed by lobbying all their competitors because it's futile if only Firefox supports it anyway.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: