From 7ee4dd046c520272f8502b9d63d00cf16cd3d011 Mon Sep 17 00:00:00 2001
From: Joris Le Blansch <ping@apio.systems>
Date: Fri, 22 May 2026 13:40:38 +0200
Subject: [PATCH] [ACME] add support for ECDSA and phase out RSA

---
 data/Dockerfiles/acme/acme.sh                   | 10 +++++-----
 data/Dockerfiles/acme/obtain-certificate-dns.sh |  3 +--
 data/Dockerfiles/acme/obtain-certificate.sh     |  3 +--
 docker-compose.yml                              |  2 +-
 4 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/data/Dockerfiles/acme/acme.sh b/data/Dockerfiles/acme/acme.sh
index 271de4fc91..c6500fa101 100755
--- a/data/Dockerfiles/acme/acme.sh
+++ b/data/Dockerfiles/acme/acme.sh
@@ -167,10 +167,10 @@ while true; do
   DOVECOT_CERT_SERIAL_NEW="$(echo | openssl s_client -connect dovecot:143 -starttls imap 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
   # Re-using previous acme-mailcow account and domain keys
   if [[ ! -f ${ACME_BASE}/acme/key.pem ]]; then
-    log_f "Generating missing domain private rsa key..."
-    openssl genrsa 4096 > ${ACME_BASE}/acme/key.pem
+    log_f "Generating missing domain private key (ECDSA P-256)..."
+    openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 > ${ACME_BASE}/acme/key.pem
   else
-    log_f "Using existing domain rsa key ${ACME_BASE}/acme/key.pem"
+    log_f "Using existing domain key ${ACME_BASE}/acme/key.pem"
   fi
   if [[ ! -f ${ACME_BASE}/acme/account.pem ]]; then
     log_f "Generating missing Lets Encrypt account key..."
@@ -352,7 +352,7 @@ while true; do
     VALIDATED_CERTIFICATES+=("${CERT_NAME}")
 
     # obtain server certificate if required
-    DOMAINS=${SERVER_SAN_VALIDATED[@]} /srv/obtain-certificate.sh rsa
+    DOMAINS=${SERVER_SAN_VALIDATED[@]} /srv/obtain-certificate.sh ecdsa
     RETURN="$?"
     if [[ "$RETURN" == "0" ]]; then # 0 = cert created successfully
       CERT_AMOUNT_CHANGED=1
@@ -394,7 +394,7 @@ while true; do
       CERT_NAME=${VALIDATED_DOMAINS_SORTED[0]}
       VALIDATED_CERTIFICATES+=("${CERT_NAME}")
       # obtain certificate if required
-      DOMAINS=${VALIDATED_DOMAINS_SORTED[@]} /srv/obtain-certificate.sh rsa
+      DOMAINS=${VALIDATED_DOMAINS_SORTED[@]} /srv/obtain-certificate.sh ecdsa
       RETURN="$?"
       if [[ "$RETURN" == "0" ]]; then # 0 = cert created successfully
         CERT_AMOUNT_CHANGED=1
diff --git a/data/Dockerfiles/acme/obtain-certificate-dns.sh b/data/Dockerfiles/acme/obtain-certificate-dns.sh
index f88089f016..ba2572a632 100644
--- a/data/Dockerfiles/acme/obtain-certificate-dns.sh
+++ b/data/Dockerfiles/acme/obtain-certificate-dns.sh
@@ -22,8 +22,7 @@ fi
 
 TYPE=${1}
 PREFIX=""
-# only support rsa certificates for now
-if [[ "${TYPE}" != "rsa" ]]; then
+if [[ "${TYPE}" != "rsa" && "${TYPE}" != "ecdsa" ]]; then
   log_f "Unknown certificate type '${TYPE}' requested"
   exit 5
 fi
diff --git a/data/Dockerfiles/acme/obtain-certificate.sh b/data/Dockerfiles/acme/obtain-certificate.sh
index 9d727a2027..244ff5edc5 100644
--- a/data/Dockerfiles/acme/obtain-certificate.sh
+++ b/data/Dockerfiles/acme/obtain-certificate.sh
@@ -15,8 +15,7 @@ ACME_BASE=/var/lib/acme
 
 TYPE=${1}
 PREFIX=""
-# only support rsa certificates for now
-if [[ "${TYPE}" != "rsa" ]]; then
+if [[ "${TYPE}" != "rsa" && "${TYPE}" != "ecdsa" ]]; then
   log_f "Unknown certificate type '${TYPE}' requested"
   exit 5
 fi
diff --git a/docker-compose.yml b/docker-compose.yml
index eab23c8a04..50d81ab4fc 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -465,7 +465,7 @@ services:
           condition: service_started
         unbound-mailcow:
           condition: service_healthy
-      image: ghcr.io/mailcow/acme:1.97
+      image: ghcr.io/mailcow/acme:2.00
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       environment: