CSR plugins are responsible for providing certificate requests that the ACME server can sign.

RSA

--csr rsa (default)

Default plugin, generates 3072 bits RSA key pairs. The number of bits can be configured in settings.config but may not be less than 2048.

EC

--csr ec

Generates ECDSA keys based on the secp384r1 curve. The curve to use can be configured in settings.config but currently only SEC named curves are supported and Let's Encrypt also has limitations.

Common features

• The OCSP Must Staple extension can be added to any CSR with the command line option --ocsp-must-staple
• The option --reuse-privatekey can be used to keep using the same private key across different renewals