I need to update a CA that is about to expire, currently is using Signature Algorithm 256WithRSAEncryption and I am thinking in using ecdsa-with-SHA256 with something like:

openssl req -x509 -nodes -days 3650 \
  -newkey ec:<(openssl ecparam -name prime256v1) \
  -keyout certs/CA.pem -out certs/CA.crt -subj "/CN=myCA"

Besides updating, recreating existing certificates, wondering if there is something that I should take care of when using ecdsda signatures?

  • 1
    CA key rollovers can be complicated if you start going down the cross-cert backwards-compatibility route, but I don't think there's anything specific to ECDSA that you need to worry about. – Mike Ounsworth Mar 17 '19 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.