6

We all love Ethereum/Bitcoin (i.e. EC secp256k1) private keys, because they let us sign transactions. However, browsers don't support those keys for authentication -- what they do (sort of) support is client-side SSL certs.

So the obvious question that comes to mind is: what would it be like to generate an X.509 SSL certificate from an Ethereum (or Bitcoin for that matter) private key? Would servers recognise such authenticated HTTPS connections? What support would be missing on client side?

To sum that up, the first workflow that I have in mind is SSL client auth:

  1. I (the user) generate an SSL cert from an Ethereum private key (once) and imports it into the browser
  2. I log into a website by providing that cert
  3. The website trusts that I own the corresponding Ethereum address. Note that this won't let me sign any transaction, but it at least will let me prove that I own that address. Depending on the use case, that is sometimes sufficient.

Another workflow that comes to mind is CAs (Certification Authorities, think "Verisign"). The job of a CA is to sign X.509 certificates. So if I could generate a certificate from an Ethereum address, I could have that certificate signed by a CA and thus bridge Ethereum with the huge web-of-trust infrastructure that already exists. All those well-established CAs could start signing EC certs, thus anchoring Ethereum addresses to real-life entities.

So the key part is deriving a client or server X.509 cert from an EC private key. Is that at all doable? What are the obstacles or impediments?

Improve this question
1

1 Answer 1

Reset to default
4

It is possible to create certificates with secp256k1 keys using OpenSSL, for example following OpenSSL generate different types of self signed certificate.

The main problem is certificates with secp256k1 keys are not well supported. For example most popular browsers only support secp256r1 and secp384r1, but not secp256k1 https://www.ssllabs.com/ssltest/clients.html.

Improve this answer
2
  • Thanks! Voting the answer up. I would even mark it as the expected answer but you didn't cover the bit about CAs. Thank you very much for the information and the links.
    – David Ammouial
    Commented Dec 10, 2017 at 18:30
  • Sorry I didn't have to deal with CA so I do not know about that. Technically it should be possible to sign a certificate with any ellipctic curve. But the CAs have their own rules that have to follow, so you will have to ask them directly.
    – Ismael ♦
    Commented Dec 11, 2017 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.