X.509 Certificate using Edwards curve

Build Openssl

This requires openssl 1.1.1

wget https://www.openssl.org/source/openssl-1.1.1.tar.gz
tar xf openssl-1.1.1.tar.gz
cd openssl-1.1.1/
./config
make

This should generate a binary apps/openssl

$ apps/openssl version
OpenSSL 1.1.1  11 Sep 2018

To load the ssl dynamic library on osx, remember to use DYLD_LIBRARY_PATH instead of LD_LIBRARY_PATH :

export DYLD_LIBRARY_PATH=`pwd`/libssl.dylib

Generate a key pair and CSR

$ openssl genpkey -algorithm Ed25519 -out key.pem
$ openssl pkey -in key.pem -noout -text
ED25519 Private-Key:
priv:
    83:e7:b8:c2:e2:2e:d5:36:24:92:e5:a1:7d:19:7e:
    98:7e:d1:ef:f3:0e:fb:52:d4:72:b1:95:79:32:b4:
    ba:a1
pub:
    99:6e:ac:2f:39:97:3d:0d:1b:69:b0:64:75:5c:d1:
    c3:e7:6d:ab:61:1f:90:72:4b:51:c5:30:64:f8:b8:
    40:fe
$ openssl req -config openssl.cnf -key key.pem -new -subj '/CN=ed25519.surfnet.nl' -out csr.pem
$ openssl req -config openssl.cnf -in csr.pem -noout -text
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: CN = ed25519.surfnet.nl
        Subject Public Key Info:
            Public Key Algorithm: ED25519
                ED25519 Public-Key:
                pub:
                    99:6e:ac:2f:39:97:3d:0d:1b:69:b0:64:75:5c:d1:
                    c3:e7:6d:ab:61:1f:90:72:4b:51:c5:30:64:f8:b8:
                    40:fe
        Attributes:
            a0:00
    Signature Algorithm: ED25519
         14:80:3b:cc:a7:34:02:30:ca:da:f4:b6:f6:3b:88:8e:2c:b4:
         90:e5:98:0c:c7:2d:67:95:58:50:49:34:7a:40:e8:6a:4d:12:
         86:8d:d9:a8:62:3d:8f:96:34:11:e1:5a:a8:84:3b:dc:10:5b:
         9e:53:35:02:d5:dd:bd:81:6d:09

Note that although ed25529 is allowed in TLS, it is not implemented in browsers as the CA/B forum doesn't allow it (yet). See https://cabforum.org/pipermail/servercert-wg/2018-December/000466.html