Skip to content

Also support signing CSRs with Ed25519 keys#468

Closed
inteon wants to merge 1 commit intoletsencrypt:mainfrom
inteon:add_Ed25519_support
Closed

Also support signing CSRs with Ed25519 keys#468
inteon wants to merge 1 commit intoletsencrypt:mainfrom
inteon:add_Ed25519_support

Conversation

@inteon
Copy link
Copy Markdown

@inteon inteon commented Jun 14, 2024

Background:
We use pebble to test cert-manager. We are still using an older pebble version that did not verify the CSR signature algorithm (before #386). One of our tests makes sure that we can use ACME to obtain a Certificate for a Ed25519 CSR, we were surprised that this signature algorithm is no longer allowed by pebble.

Proposed change:
Add support for signing CSRs signed by Ed25519 keys.

Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
@aarongable
Copy link
Copy Markdown
Contributor

Pebble is intended as a test bed for ACME clients that will eventually integrate with Boulder or other WebPKI ACME servers. For better or for worse, Ed25519 is not an accepted public key algorithm in the Public WebPKI. Adding support for Ed25519 here runs the risk of causing client authors or site operators to believe that Ed25519 issuance is also possible in production, so it is unlikely that we will accept this PR.

@inteon
Copy link
Copy Markdown
Author

inteon commented Jun 17, 2024

Pebble is intended as a test bed for ACME clients that will eventually integrate with Boulder or other WebPKI ACME servers. For better or for worse, Ed25519 is not an accepted public key algorithm in the Public WebPKI. Adding support for Ed25519 here runs the risk of causing client authors or site operators to believe that Ed25519 issuance is also possible in production, so it is unlikely that we will accept this PR.

Thank you for the feedback!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants