1

Is it possible to configure Apache2 to use elliptic curve crypto (ecc) with SSL? This bug https://issues.apache.org/bugzilla/show_bug.cgi?id=40132 appears (to me) to indicate that this is supported, but I can't find any instructions anywhere.

4 Answers 4

1

Apache supports ECC Certificates and Protocols as of version 2.2.26. Though if you are using an Apache server from a distro's repository it may be the same version. Ubuntu for example added support in version 2.2.22-1ubuntu1.9.

If you have a version that supports ECC certificates, it should be enabled by default. Assuming you're using OpenSSL, the commands to generate an ECC key and CSR are:

ECC P-256 Key:

openssl ecparam -out server.key -name prime256v1 -genkey

ECC CSR:

openssl req -new -key server.key -out server.csr

The installation steps for ECC certs in Apache are identical to RSA. You'd still specify the public key entry, private key entry, and the relevant intermediates. Just double check that your CA supports the issuance of ECC certificates. You can double check ECC compatibility to address any concerns with connecting clients.

1

Or rather look here http://httpd.apache.org/docs/2.4/mod/mod_ssl.html

Support for EC Key Exchange has been added here.

1
  • Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – Scott Pack
    Sep 12, 2013 at 13:51
0

It doesn't look like it. You can find a list of supported Ciphers here: http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslciphersuite

0

Apache 2.4 has the support for ECC in the trunk and you could download or update or build those versions of Apache. Also, if you would like to use ECC then you would also need a OpenSSL version that provides the plumbing for it. Also the OpenSSL version should have the optimizations that Google engineers have contributed for speeding up ECC operations. For more details on Apache and OpenSSL (building with ECC), please see:

http://khanna111.com/wordPressBlog/2012/09/11/94087-2/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .