Mastering Linux Security and Hardening - Second Edition

Creating an EC key and a CSR

Up until a few years ago, you would have wanted to use RSA keys on your web servers. They don't have the security weaknesses that certain other key types have, and they're widely supported by pretty much every web browser. But RSA keys do have two weaknesses:

• Even at the standard 2,048-bit length, they require more computational power than other key types. Increasing the key length for better security would degrade web server performance.
• RSA doesn't offer Perfect Forward Secrecy (PFS). In other words, if someone were to capture a session key that's produced by the RSA algorithm, they would be able to decrypt material from the past. If the same person were to capture a session key that was produced by a PFS algorithm, ...