Boulder: Please support EdDSA certificates

[Darkspirit]

https://datatracker.ietf.org/doc/draft-ietf-curdle-pkix/?include_text=1

• go-jose v2 supports Ed25519
• OpenSSL supports Ed25519 & Ed448
• BoringSSL supports Ed25519
• NSS integrates Ed25519

And thank you for Let's Encrypt in general!

[jsha]

Sorry, the doc you linked is still a draft. We won't be issuing EdDSA certificates until they're fully standardized and we do a review of dependencies and the relevant documents that govern issuance.

[Darkspirit]

https://tools.ietf.org/html/rfc8410 :tada:
Please reopen ;)

[tdelmas]

@jsha ping?

[jrchamp]

I asked the same question somewhere else and the answer I received back was "CA/B Forum does not allow EdDSA as part of the Baseline Requirements yet". Unfortunately, I don't know where to find updated information on when EdDSA will be in the BR.

[tdelmas]

@jrchamp I found https://community.letsencrypt.org/t/support-ed25519-and-ed448/69868 about it.

[JamesTheAwesomeDude]

I found https://community.letsencrypt.org/t/support-ed25519-and-ed448/69868

From that post at the bottom of the thread (authoritative necro by moderator just last Tuesday), we're allegedly just waiting on

• "Browsers need to implement it." (At least Firefox (Nightly) and Google Chrome have since over 2 years ago—so I'm not sure what he meant by this)
• "CA/Browser Forum needs to pass a ballot allowing its use." (I know this isn't LE-specific, it affects all CAs therefore all website owners; but is there anywhere for us webmasters to lurk news on it? My meager google-fu seems to have pretty bleak implications for this topic...)

for LE to be able to sign certs based on the new curve, right?

[tdelmas]

@JamesTheAwesomeDude the last part of the message is a blocking point too:

Note that we won’t be able to generate Ed25519 intermediate certificates until / unless our HSM vendor releases firmware supporting them.

[hotaru2k3]

lack of an intermediate doesn't block supporting end entity certificates, as the current status of ECDSA shows.

[jsha]

Please consolidate the conversation over on the forum. Thanks!