Support for EC certificates

[haarp]

Hello,

there's an issue when using HTTPS, DOWNLOAD_PROTO_HTTPS, certain kinds of certificates and ipxe as of today's 390bce9.

On servers using EC(256) certificates, the TLS handshake will fail. iPXE will log Operation not permitted (https://ipxe.org/410de18f) and received fatal alert 40. If the server is switched to using RSA certificates, TLS works as expected.

My crypto knowledge is limited, but the crypto page reveals that only the RSA pubkey algorithm is supported, which seems to be the issue.

Unfortunately EC certs are becoming the norm. Tools like lego use EC256 by default. Some servers like nginx allow running both RSA and EC certs in parallel, but that's not always an option, requires cooperation of admins and software, and understanding why iPXE fails in this manner in the first place. And either way, EC is on the way to replace RSA eventually.

I'd like to request that iPXE gain support for EC. I know this is far from trivial, but probably the best solution of dealing with this.

Thanks a lot! and thanks for making iPXE!

[mcb30]

iPXE does not advertise support for EC server certificates. We do have support for elliptic curves, but only for key exchange (i.e. the ECDHE variants of the cipher suites), and the only supported curve is x25519.

I'm happy to add support for EC certificates as soon as anyone wants to fund the development work. (To preempt the inevitable future pull requests: please note that the cost of reviewing a contributed PR is more than the cost of doing the development work, because code review is always more time consuming than code creation.)

[martafolf]

The lack of support for EC certs caused me some headaches today as I was trying to fetch a resource from a domain which was automatically enrolled with one.

You mention that you're looking for funding for the development work and would prefer to do it yourself instead of others, would you be able to estimate that would look like how much funding would be needed for this to be implemented?

[mcb30]

You mention that you're looking for funding for the development work and would prefer to do it yourself instead of others, would you be able to estimate that would look like how much funding would be needed for this to be implemented?

I've replied directly by email.