The private key generated by the ECDSA algorithm cannot be imported about certify HOT 7 CLOSED

from certify.

Thanks, are you using the latest version of the app and are you aware that the app already generates it's own private keys?

from certify.

The application of CertifyTheWebSetup_v6.0.14.exe

Even if the new domain name is created, the first step is to add ECDSA to generate a private key, which will prompt this error. However, the private key generated by RSA has no such problem whether it is new domain name or before modification.

from certify.

Thanks, so do you want to use a custom ECDSA key or can you use the one the application generates itself? Most users do not supply their own keys.

from certify.

The demand here is to customize CSR, and CSR is associated with the private key! It's not to customize the private key. But it is obviously an imperfect problem with the Certify application itself

from certify.

The problem is that OpenSSL is emitting the key like this:

-----BEGIN EC PARAMETERS-----
BggqhkjOPQMBBw==
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIPXwsorl9KGaY+dETyUCUmSkWwmFKQI76DSED2nB+l6aoAoGCCqGSM49
AwEHoUQDQgAExGw/NCe56HtwU9ojOzmJnNTuxjaYmO14yQTJvOSqfZwmHqVnHRps
KGmhIRorueQrywZoR7Hu8DirD0NH6OCVvA==
-----END EC PRIVATE KEY-----

but the app is expecting this:

-----BEGIN EC PRIVATE KEY-----
MHcCAQEEIPXwsorl9KGaY+dETyUCUmSkWwmFKQI76DSED2nB+l6aoAoGCCqGSM49
AwEHoUQDQgAExGw/NCe56HtwU9ojOzmJnNTuxjaYmO14yQTJvOSqfZwmHqVnHRps
KGmhIRorueQrywZoR7Hu8DirD0NH6OCVvA==
-----END EC PRIVATE KEY-----

We will update the app to remove the extra EC PARAMETERS block openssl adds but you can alternatively use the -noout option to exclude the EC Params in the output:

openssl ecparam -name prime256v1 -genkey -noout -out test.key

Generally when people want to use a Custom CSR it's because the CSR is already provided (and they don't have the key because it's embedded in whatever system they are trying to generate a cert for). Also a CSR for a Let's Encrypt certificate etc can only include domain identifiers so things like OU, Country etc are ignored. I'm interested in knowing what customization you require for the CSR if you can share that.

from certify.

Thank you, I can try whether it is feasible

from certify.