Feature #9843: allow to generate cert/csr with ECDSA key - pfSense - pfSense bugtracker

Feature #9843

allow to generate cert/csr with ECDSA key

Added by Viktor Gurov over 1 year ago. Updated over 1 year ago.

Status:

Resolved

Priority:

Normal

Assignee:

Jim Pingle

Category:

Certificates

Target version:

2.5.0

Start date:

10/23/2019

Due date:

% Done:

100%

Estimated time:

Release Notes:

Default

Description

Add ability to generate certificates/CSRs with ECDSA keys.

Screenshot from 2019-10-23 11-47-52.png (39.4 KB) Screenshot from 2019-10-23 11-47-52.png

interface screenshot

Viktor Gurov, 10/23/2019 03:49 AM

Associated revisions

Revision c3cda38e (diff)
Added by Jim Pingle over 1 year ago

Change default ECSDA curve to prime256v1. Issue #9843

Previous default was brainpool, but brainpool curves are not (widely?)
supported by browsers and were deprecated by IETF for TLS v1.3

Revision cffcf9bf (diff)
Added by Jim Pingle over 1 year ago

GUI improvements for ECDSA certificate handling

Make central functions to check and test ECDSA compatibility. Issue #9843
Filter incompatible certificates from being offered for the GUI or Captive Portal. Implements #9897
Do the same for IPsec, which implements #4991
Add a check for key type when generating ipsec.secrets to allow ECDSA certs to work in IPsec for issue #4991

Note that as of this moment, the following curves are known to be compatible:
HTTPS (GUI, Captive Portal): prime256v1, secp384r1
IPsec: prime256v1, secp384r1, secp521r1

Results may vary in other areas which are not yet well-tested, and in packages.