On Wed, May 28, 2014, Matt Caswell wrote: > On 28 May 2014 11:06, Sverre Moe <[email protected]> wrote: > > I used the following openssl command for my ECC private key and CSR. > > openssl ecparam -name secp521r1 -genkey -param_enc explicit -out > > private-key.pem > > openssl req -new -key private-key.pem -nodes -sha384 -out ecc_clientReq.csr > > > > So what is the point of this switch? > > -param_enc explicit > > Can't find any information about this on > > https://www.openssl.org/docs/apps/req.html > > > Well, as its a switch for ecparam not req, its not document on the req page! > :-) > > It is documented here: > > http://www.openssl.org/docs/apps/ecparam.html > > I suggest you do not use it, and go with the default of named curves. > In most circumstances that is what you really want. In theory you can > use your own custom curve, in which case you would have to use > explicit parameters. But in practice no one really does that - > everyone just uses standard named curves. >
In theory you can use custom curves but in the case of TLS almost nothing supports it (OpenSSL doesn't) and using explicit parameters will often just fail even with common curves. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
