Also support signing CSRs with Ed25519 keys#468
Also support signing CSRs with Ed25519 keys#468inteon wants to merge 1 commit intoletsencrypt:mainfrom
Conversation
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
|
Pebble is intended as a test bed for ACME clients that will eventually integrate with Boulder or other WebPKI ACME servers. For better or for worse, Ed25519 is not an accepted public key algorithm in the Public WebPKI. Adding support for Ed25519 here runs the risk of causing client authors or site operators to believe that Ed25519 issuance is also possible in production, so it is unlikely that we will accept this PR. |
Thank you for the feedback! |
Background:
We use pebble to test cert-manager. We are still using an older pebble version that did not verify the CSR signature algorithm (before #386). One of our tests makes sure that we can use ACME to obtain a Certificate for a Ed25519 CSR, we were surprised that this signature algorithm is no longer allowed by pebble.
Proposed change:
Add support for signing CSRs signed by Ed25519 keys.