How do I change the default security settings?

[julieolson-gs]

Good day! We are attempting to troubleshoot a validation issue, and think we've narrowed it down to the default security settings are set to ECC, whereas the CA service we have set up will only issue RSA. We are struggling to find a way to change these settings, is there a way to do that?

Certbot has a similar setting but you are able to modify this configuration.

I'm attaching a screenshot of the settings we'd like to change.

Thanks!

[WouterTinus]

Actually using RSA private keys is the default, so I'm afraid that is not your issue. Perhaps try a different key size?

[julieolson-gs]

Interesting! Just to confirm the default hash algorithm is RSA SHA 512?

Thank you for the test build. Do you know when this new version will be released?

[WouterTinus]

Yes the default is SHA512withRSA if you are using an RSA private key.

[julieolson-gs]

We tried the test build and it worked! We confirmed issuance for both 256 and 384. Thank you!

Do you know when this release will go live?

Also, do you know what the full acceptable values for csr.signatureAlgorithm are? We have confirmed RSA SHA256 and 384.

[WouterTinus]

This has been released in 2.2.5. Note that there have been some changes since the test build. The config values are now Csr.Rsa.SignatureAlgorithm and Csr.Ec.SignatureAlgorithm. The full list of available algorithms is here: https://github.com/bcgit/bc-csharp/blob/master/crypto/src/cms/CMSSignedGenerator.cs

[julieolson-gs]

Many many thanks @WouterTinus !