search

diafygi / acme-tiny

A tiny script to issue and renew TLS certs from Let's Encrypt
MIT License
4.73k stars 571 forks source link

Is it possible for this script to support ECDSA ? #83

Open Remonli opened 8 years ago

Remonli commented 8 years ago

Hello,

Let's Encrypt now support ECC keys,is it possible for you to update this script ? You can check here: https://community.letsencrypt.org/t/ecdsa-testing-on-staging/8809

Thank you for your kind reply. Li

diafygi commented 8 years ago

Hmmm, maybe, but can it be added and keep the script under 200 lines?

drdaeman commented 8 years ago

I implemented EC keys support, but I haven't noticed 200 SLOC disclaimer (sorry!), so, if you count the empty lines and comments, the script grew above the threshold.

Well, I guess I can easily cut out at least 11 lines that parse DER, by making code more cryptic (will have to rely on "magic" offsets instead of calling openssl asn1parse). Then, possibly, remove some safety checks/assertions about key material, as bad data willl be rejected by the server anyway...

drdaeman commented 8 years ago

Uh. Well, I had managed to squeezed everything down to 200 lines exactly, but that went against the very idea of why the limitation is there and felt like participating into an obfuscated programming contest. I don't like what I did, and did that only to see if having low wc -l acme_tiny.py is even possible. The only optimization I actually found good is factoring out all those openssl calls into a function.

I think I'll give up at this point. It works for me, anyway. Whoever has any good idea how to make this into a good PR, suitable for the project, please do so.

tchernomax commented 8 years ago

I agree with @drdaeman . It's preferable to increase a bit the number of lines and update the main README "200 SLOC" → "250 SLOC", than to write semi-obfuscated code.

jedisct1 commented 8 years ago

Make it a round number: 256 lines.

ScottHelme commented 8 years ago

You can get ECDSA server certificates without any changes, which is what the thread linked was regarding. Do they accept ECDSA account keys?

HansVanEijsden commented 8 years ago

ECDSA works great. As you can see @ https://www.weblogzwolle.nl also with a secp384r1 curve. This is how I do it, maybe it helps you: http://pastebin.com/cRAtip4z

olmari commented 8 years ago

Confirmed, using info from paste that @HansVanEijsden gave I was able to create ECDSA-certificate. More accurately: I used mine RSA account.key (I believe that doens't matter here, it is for authenticating "me" into LE, not relating to certificate itself) and EC domain.key.

Currently Lets Encrypt only has RSA intermediate, but that will also change in the future. I don't know will LE/ACME/Boulder automatically sign EC.csr with EC-intermediate or does it involve some sort of manual switch/parameter... This is something acme-tiny might need to be prepared when it happends (currently their upcoming features says "Before March 31, 2017". Otherwise EC(DSA) certificate making works well in current situation.

pfoo commented 7 years ago

Any update on merging this ? I understand the whole <200 lines thing, but isn't adding a major feature worth a few more lines ?

rotanid commented 7 years ago

@pfoo it seems @diafygi isn't caring about acme-tiny anymore :-(

andreasscherbaum commented 7 years ago

One can always fork it ... I'm using my own fork, but need to upgrade it as well.

olmari commented 7 years ago

So what is the problem? ECDSA-certs already... Just read this ticket...

pfoo commented 7 years ago

I was actually speaking of @drdaeman implementation of ECDSA account key support, ecdsa for domain key is already supported.

olmari commented 7 years ago

Ah.. well.. this ticket was originally AFAIK about ECDSA cert-key, not account...

diafygi commented 5 years ago

@rotanid I do still very much care about acme-tiny and I use it in my systems all the time. Adding features !== not caring.

As far as ECDSA support, I'm open to pull requests as long as it stays tiny. I just haven't started playing around with them very much myself so I haven't dug into how hard that would be.

olmari commented 5 years ago

@diafygi your version of acme-tiny already supports ECDSA certs, all that is needed is to use ECC-key, like PR https://github.com/diafygi/acme-tiny/pull/129 implies, nothing is needed to be done to the acme-tiny code itself.

olmari commented 4 years ago

So, could we just close this ticket as ECDSA certifikate (keys) works without problems with current script, as they have always, or what are we really waiting for? :)

diafygi commented 4 years ago

I think is about ECDSA account keys, not domain certificate keys, right?

olmari commented 4 years ago

AFAIK original question was not about account keys, while at almost immediately by some twist or oversight talk steered into account keys... if we are purely talking about acconut keys, then maybe change title or do new more specific issue? :)