Is it possible for this script to support ECDSA ? about acme-tiny HOT 19 OPEN

I agree with @drdaeman .
It's preferable to increase a bit the number of lines and update the main README "200 SLOC" → "250 SLOC", than to write semi-obfuscated code.

from acme-tiny.

AFAIK original question was not about account keys, while at almost immediately by some twist or oversight talk steered into account keys... if we are purely talking about acconut keys, then maybe change title or do new more specific issue? :)

from acme-tiny.

Make it a round number: 256 lines.

from acme-tiny.

Confirmed, using info from paste that @HansVanEijsden gave I was able to create ECDSA-certificate. More accurately: I used mine RSA account.key (I believe that doens't matter here, it is for authenticating "me" into LE, not relating to certificate itself) and EC domain.key.

Currently Lets Encrypt only has RSA intermediate, but that will also change in the future. I don't know will LE/ACME/Boulder automatically sign EC.csr with EC-intermediate or does it involve some sort of manual switch/parameter... This is something acme-tiny might need to be prepared when it happends (currently their upcoming features says "Before March 31, 2017". Otherwise EC(DSA) certificate making works well in current situation.

from acme-tiny.

I implemented EC keys support, but I haven't noticed 200 SLOC disclaimer (sorry!), so, if you count the empty lines and comments, the script grew above the threshold.

Well, I guess I can easily cut out at least 11 lines that parse DER, by making code more cryptic (will have to rely on "magic" offsets instead of calling openssl asn1parse). Then, possibly, remove some safety checks/assertions about key material, as bad data willl be rejected by the server anyway...

from acme-tiny.

ECDSA works great. As you can see @ https://www.weblogzwolle.nl also with a secp384r1 curve. This is how I do it, maybe it helps you: http://pastebin.com/cRAtip4z

from acme-tiny.

@diafygi your version of acme-tiny already supports ECDSA certs, all that is needed is to use ECC-key, like PR #129 implies, nothing is needed to be done to the acme-tiny code itself.

from acme-tiny.

So, could we just close this ticket as ECDSA certifikate (keys) works without problems with current script, as they have always, or what are we really waiting for? :)

from acme-tiny.

Hmmm, maybe, but can it be added and keep the script under 200 lines?

from acme-tiny.

Uh. Well, I had managed to squeezed everything down to 200 lines exactly, but that went against the very idea of why the limitation is there and felt like participating into an obfuscated programming contest. I don't like what I did, and did that only to see if having low wc -l acme_tiny.py is even possible. The only optimization I actually found good is factoring out all those openssl calls into a function.

I think I'll give up at this point. It works for me, anyway. Whoever has any good idea how to make this into a good PR, suitable for the project, please do so.

from acme-tiny.

You can get ECDSA server certificates without any changes, which is what the thread linked was regarding. Do they accept ECDSA account keys?

from acme-tiny.

Any update on merging this ?
I understand the whole <200 lines thing, but isn't adding a major feature worth a few more lines ?

from acme-tiny.

@pfoo it seems @diafygi isn't caring about acme-tiny anymore :-(

from acme-tiny.

One can always fork it ... I'm using my own fork, but need to upgrade it as well.

from acme-tiny.

So what is the problem? ECDSA-certs already... Just read this ticket...

from acme-tiny.

I was actually speaking of @drdaeman implementation of ECDSA account key support, ecdsa for domain key is already supported.

from acme-tiny.

Ah.. well.. this ticket was originally AFAIK about ECDSA cert-key, not account...

from acme-tiny.

@rotanid I do still very much care about acme-tiny and I use it in my systems all the time. Adding features !== not caring.

As far as ECDSA support, I'm open to pull requests as long as it stays tiny. I just haven't started playing around with them very much myself so I haven't dug into how hard that would be.

from acme-tiny.

I think is about ECDSA account keys, not domain certificate keys, right?

from acme-tiny.