Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The recommendation to use a 1024-bit RSA key worries me. In an era of passive, bulk surveillance, that seems too weak if you're not going to be using any additional transport-layer security.

The performance argument is only relevant for the establishment of the VPN connection and any periodic rekeying ­— it shouldn't have any impact on the tunnel's perf.

It's a shame openvpn's easy-rsa doesn't provide a straightforward mechanism to generate ECDSA certificates, which would've removed any performance concerns.

--

edit: easy-rsa does support ECDSA[1]:

Support for generating an ECDSA certificate chain is available in EasyRSA (in spite of it's name) since EasyRSA 3.0. The parameters you're looking for are '--use-algo=ec' and '--curve=<curve_name>'. See the EasyRSA documentation for more details on generating ECDSA certificates.

https://github.com/OpenVPN/openvpn/blob/master/README.ec



Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: