AutoSSL Key Length

[BiDouiLle]

Hi there,

I am messing arround with CWP since a few weeks now and I like it a lot.

I have been able to correctly build Let's Encrypt certificates using AutoSSL.

But I have a question for the community, does someone managed to produce a certificate with a 4096 key length instead of 2048 which is the default ?

Thank you in advance for yours answer(s).

Regards.

Louis

[Jamshed Datori]

It will better if you can contact them directly about this suggestion.

http://centos-webpanel.com/contact

[BiDouiLle]

Hi Jamshed_206,

Thank you for your answer.

I'll do it for sure as acme.sh supports the ACME 2 protocol served by LE, it enables the use of wildcard certificates, other challenge method (DNS is mandatory for wildcard) and is even compatible with API of a bunch of DNS providers, longer key length and ECDSA certificates.

Nice things could be done with the right wrappers.

Regards.

Louis

[BiDouiLle]

Hi all,

For those interested in playing with certificates, you can modify key length and certificates type and extensions like "must staple" modifying directly acme.sh script.

/!\ DO NOT DO THAT ON PROD UNTIL YOU'RE CONFIDENT WITH WHAT IT IMPLIES /!\

First make a copy of the original script

Code Select Expand

cp /root/.acme.sh/acme.sh /root/.acme.sh/acme.sh.bak

Then we will work on a copy using vim or another editor you like :

Code Select Expand

vim /root/.acme.sh/acme.sh

And we edit lines 36 for key length and/or certificate type and 6269 for adding "must staple" extension :
L36 :

Code Select Expand

DEFAULT_DOMAIN_KEY_LENGTH="2048"
Becomes :

Code Select Expand

DEFAULT_DOMAIN_KEY_LENGTH="4096" for 4096 bits RSA
Or :

Code Select Expand

DEFAULT_DOMAIN_KEY_LENGTH="ec-384" for 384 bits ECDSA

L6269 you'll find :

Code Select Expand

  _notify_mode=""
  while [ ${#} -gt 0 ]; do
Add a line between those two ones ending with the following text :

Code Select Expand

  _notify_mode=""
  Le_OCSP_Staple="1"
  while [ ${#} -gt 0 ]; do
It will add "must staple" to your certificate.

A lot of other things could done like that like wildcard certificates, dns check (needed for wildcard) but for those 2 the SSL certificates manager behavior could not be predicted.