To clarify, Firefox/Mozilla the organization enforces an unexplained
policy of prohibiting all included CAs from issuing any P-521
certificate, thus effectively banning their use on public servers
regardless of technical abilities.
On 15/10/2019 19:02, Mark Hack wrote:
I believe that Firefox doe
On Oct 15, 2019, at 1:02 PM, Mark Hack wrote:I believe that Firefox does still support P-521 but Chrome does not. Also be aware that if you set server side cipher selection and usedefault curves, that OpenSSL orders the curves weakest to strongest (even with @STRENGTH) so you will end up forcing
I believe that Firefox does still support P-521 but Chrome does not.
Also be aware that if you set server side cipher selection and use
default curves, that OpenSSL orders the curves weakest to strongest (
even with @STRENGTH) so you will end up forcing P-256.
On Tue, 2019-10-15 at 17:24 +0200,
On 15/10/2019 15:43, Stephan Seitz wrote:
Hi!
I was looking at the output of „openssl ecparam -list_curves” and
trying to choose a curve for the web server together with letsencrypt.
It seems, letsencrypt supports prime256v1, secp256r1, and secp384r1.
Then I found the site https://safecurves
On Tue, 2019-10-15 at 15:43 +0200, Stephan Seitz wrote:
> Hi!
>
> I was looking at the output of „openssl ecparam -list_curves” and
> trying
> to choose a curve for the web server together with letsencrypt.
>
> It seems, letsencrypt supports prime256v1, secp256r1, and secp384r1.
>
> Then I foun
There is nothing known to be wrong with NIST P256. If you don't have a known
reason to use 384, then don't use it.
Hi!
I was looking at the output of „openssl ecparam -list_curves” and trying
to choose a curve for the web server together with letsencrypt.
It seems, letsencrypt supports prime256v1, secp256r1, and secp384r1.
Then I found the site https://safecurves.cr.yp.to/.
I have problems mapping the ope
