From 0e31b188fd38db611d4fbab7de9373a95f36aae5 Mon Sep 17 00:00:00 2001 From: Jonathan Rudenberg Date: Thu, 8 Sep 2016 21:05:11 -0400 Subject: [PATCH] acme/autocert: use ECDSA P-256 for account key and issued certs ECDSA P-256 keys are smaller than RSA 2048 keys and signing operations are faster. Change-Id: I735f358f17ada4569de307a7af2934d4abf69b91 Reviewed-on: https://go-review.googlesource.com/28851 Run-TryBot: Alex Vaghin TryBot-Result: Gobot Gobot Reviewed-by: Alex Vaghin --- acme/autocert/autocert.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/acme/autocert/autocert.go b/acme/autocert/autocert.go index 605cc00..2d95e27 100644 --- a/acme/autocert/autocert.go +++ b/acme/autocert/autocert.go @@ -12,6 +12,7 @@ import ( "bytes" "crypto" "crypto/ecdsa" + "crypto/elliptic" "crypto/rand" "crypto/rsa" "crypto/tls" @@ -127,7 +128,7 @@ type Manager struct { // Client is used to perform low-level operations, such as account registration // and requesting new certificates. // If Client is nil, a zero-value acme.Client is used with acme.LetsEncryptURL - // directory endpoint and a newly-generated 2048-bit RSA key. + // directory endpoint and a newly-generated ECDSA P-256 key. // // Mutating the field after the first call of GetCertificate method will have no effect. Client *acme.Client @@ -379,7 +380,7 @@ func (m *Manager) certState(domain string) (*certState, error) { return state, nil } // new locked state - key, err := rsa.GenerateKey(rand.Reader, 2048) + key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) if err != nil { return nil, err } @@ -557,7 +558,7 @@ func (m *Manager) acmeClient(ctx context.Context) (*acme.Client, error) { } if client.Key == nil { var err error - client.Key, err = rsa.GenerateKey(rand.Reader, 2048) + client.Key, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader) if err != nil { return nil, err }