[Git][debian-edu/debian-edu-config][master] 3 commits: tools/create-debian-edu-certs: Switch root CA and server key generation to ECDSA prime256v1

Mike Gabriel pushed to branch master at Debian Edu / debian-edu-config


Commits:
d5cef833 by Daniel Teichmann at 2026-08-25T19:09:26+00:00
tools/create-debian-edu-certs: Switch root CA and server key generation to ECDSA prime256v1

RSA with 2048 bits is the bare minimum with OpenSSL 3. Replace
'openssl genrsa' with 'openssl genpkey -algorithm EC' using the
prime256v1 (secp256r1 / NIST P-256) curve.

- - - - -
a15aa1fc by Daniel Teichmann at 2026-08-25T19:09:26+00:00
tools/create-server-cert: Switch key generation to ECDSA prime256v1 and drop keyEncipherment key usage

keyEncipherment is only meaningful for RSA keys. For ECDSA server
certificates only the digitalSignature key usage is applicable
(RFC 5480).

- - - - -
4bfee5ad by Daniel Teichmann at 2026-08-25T19:09:26+00:00
v3.cnf: Drop keyEncipherment from server cert key usage

keyEncipherment is not applicable to ECDSA keys (RFC 5480), only
digitalSignature is required for TLS server certificates.

- - - - -


3 changed files:

- share/debian-edu-config/tools/create-debian-edu-certs
- share/debian-edu-config/tools/create-server-cert
- share/debian-edu-config/v3.cnf


Changes:

=====================================
share/debian-edu-config/tools/create-debian-edu-certs
=====================================
@@ -32,12 +32,12 @@ SERVER_KEY="$KEY_DIR/debian-edu-server.key"
 
 generate() {
     # Generate Debian Edu root CA private key.
-    openssl genrsa -out $CA_KEY 2048
+    openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -out $CA_KEY
     # Request rootCA CSR and self-sign it to apply v3 extensions.
     openssl req -new -nodes -key $CA_KEY -out $TMP/ca.csr -config $SSL_CA_CONF
     openssl x509 -req -in $TMP/ca.csr -signkey $CA_KEY -days 3650 -out $CA_CERT -extfile $V3_CA_CONF
     # Request web server key.
-    openssl req -new -nodes -out $TMP/server.csr -newkey rsa:2048 -keyout $SERVER_KEY -config $SSL_CONF
+    openssl req -new -nodes -out $TMP/server.csr -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -keyout $SERVER_KEY -config $SSL_CONF
     # Request web server certificate.
     openssl x509 -req -in $TMP/server.csr -CA $CA_CERT -CAkey $CA_KEY -CAcreateserial -out $SERVER_CERT -days 3650 -extfile $V3_CONF
     # Adjust owner and rights.


=====================================
share/debian-edu-config/tools/create-server-cert
=====================================
@@ -139,7 +139,7 @@ tempdir=$(mktemp -d)
 cat > "${tempdir}/v3.conf"  <<EOF
 # v3.ext
 authorityKeyIdentifier=keyid,issuer
-keyUsage = digitalSignature, keyEncipherment
+keyUsage = digitalSignature
 extendedKeyUsage = serverAuth
 subjectAltName = @alt_names
 
@@ -165,7 +165,7 @@ else
 	echo "Creating new key file: ${keydir}/${keyfile}"
 	echo
 	openssl  req  -config "${tempdir}/ssl.cnf" \
-	              -nodes  -new -newkey rsa:2048 \
+	              -nodes  -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
 	              -keyout "${keydir}/${keyfile}" \
 	              -out "${tempdir}/${csrfile}"
 fi


=====================================
share/debian-edu-config/v3.cnf
=====================================
@@ -1,6 +1,6 @@
 # v3.ext
 authorityKeyIdentifier=keyid,issuer
-keyUsage = digitalSignature, keyEncipherment
+keyUsage = digitalSignature
 extendedKeyUsage = serverAuth
 subjectAltName = @alt_names
 



View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/107e8bf0bb603ee7e4f0730a33db08ffe8134ec0...4bfee5ad89b4c95e7b5c39f43cc701b38bd8a786

-- 
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/107e8bf0bb603ee7e4f0730a33db08ffe8134ec0...4bfee5ad89b4c95e7b5c39f43cc701b38bd8a786
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help

_______________________________________________
debian-edu-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-edu-commits