在MicroK8s中如何为Let's Encrypt ClusterIssuer设置ECC384加密算法？

完全可以实现，cert-manager原生支持配置ECC（椭圆曲线加密）类型的密钥，只需修改ClusterIssuer及相关证书配置即可完成切换，具体步骤如下：

1. 更新ClusterIssuer配置 #

在原有ClusterIssuer的spec.acme字段下添加privateKey配置，指定密钥算法为ECDSA、密钥大小为384。修改后的完整配置如下：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
  namespace: cert-manager
spec:
  acme:
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    email: asdf@gmail.com
    privateKeySecretRef:
      name: letsencrypt-staging
    # 添加ECC密钥配置
    privateKey:
      algorithm: ECDSA
      size: 384
    solvers:
      - http01:
          ingress:
            class: public
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: asdf@gmail.com # 注：原配置中此处少了@符号，需修正
    privateKeySecretRef:
      name: letsencrypt-prod
    # 添加ECC密钥配置
    privateKey:
      algorithm: ECDSA
      size: 384
    solvers:
      - http01:
          ingress:
            class: public

应用修改后的配置：

kubectl apply -f your-clusterissuer-config.yaml

2. 删除旧的RSA密钥Secret #

原ClusterIssuer关联的是RSA类型的密钥Secret，需要删除它让cert-manager重新生成ECC密钥：

kubectl delete secret letsencrypt-staging letsencrypt-prod -n cert-manager

3. 配置证书使用ECC密钥 #

场景1：手动创建Certificate资源 #

如果是通过Certificate资源申请证书，需在spec中添加privateKey配置：

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-cert
  namespace: default
spec:
  secretName: example-cert-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - example.com
    - www.example.com
  # 指定ECC密钥
  privateKey:
    algorithm: ECDSA
    size: 384

场景2：通过Ingress自动生成证书 #

如果用Ingress注解自动生成证书，需添加以下注解：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  namespace: default
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    # 指定ECC密钥算法和大小
    cert-manager.io/private-key-algorithm: "ECDSA"
    cert-manager.io/private-key-size: "384"
spec:
  tls:
    - hosts:
        - example.com
        - www.example.com
      secretName: example-cert-tls
  rules:
    - host: example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: example-service
                port:
                  number: 80

4. 触发证书重新颁发 #

删除现有的证书Secret或Certificate资源，让cert-manager重新签发ECC证书：

# 删除证书Secret（以example-cert-tls为例）
kubectl delete secret example-cert-tls -n default

# 或者删除Certificate资源（如果是手动创建的）
kubectl delete certificate example-cert -n default

5. 验证证书类型 #

证书签发完成后，可通过以下命令验证密钥类型：

# 导出证书公钥并查看算法
kubectl get secret example-cert-tls -n default -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -text -noout | grep "Public Key Algorithm"

正常输出应包含Public Key Algorithm: id-ecPublicKey，且下方会显示ASN1 OID: secp384r1，说明是ECC384类型的证书。

内容的提问来源于stack exchange，提问作者Myriadic