Enable ECDSA with AutoTLS

[cagriaksay]

Is there a cookbook recipe for using ECDSA CipherSuites with AutoTLS?

I'd like to improve TLS performance, that's why I'd like to default to ECDSA first. Does anyone have any other recommendations to improve TLS performance?

[aldas]

https://echo.labstack.com/docs/cookbook/auto-tls#server Docs have example how to configure autocert.Manager and tls.Config

func main() {
	e := echo.New()
	e.Use(middleware.Recover())
	e.Use(middleware.Logger())
	e.GET("/", func(c echo.Context) error {
		return c.HTML(http.StatusOK, `
			<h1>Welcome to Echo!</h1>
			<h3>TLS certificates automatically installed from Let's Encrypt :)</h3>
		`)
	})

	autoTLSManager := autocert.Manager{
		Prompt: autocert.AcceptTOS,
		// Cache certificates to avoid issues with rate limits (https://letsencrypt.org/docs/rate-limits)
		Cache: autocert.DirCache("/var/www/.cache"),
		//HostPolicy: autocert.HostWhitelist("<DOMAIN>"),
	}
	s := http.Server{
		Addr:    ":443",
		Handler: e, // set Echo as handler
		TLSConfig: &tls.Config{
			//Certificates: nil, // <-- s.ListenAndServeTLS will populate this field
			GetCertificate: autoTLSManager.GetCertificate,
			NextProtos:     []string{acme.ALPNProto},
		},
		//ReadTimeout: 30 * time.Second, // use custom timeouts
	}
	if err := s.ListenAndServeTLS("", ""); err != http.ErrServerClosed {
		e.Logger.Fatal(err)
	}
}

[cagriaksay]

Thank you for the quick response. I had seen this but was wondering if there's a working example for listing ciphers explicitly. Here's what I ended up with:

autoTLSManager := autocert.Manager{
  Prompt:     autocert.AcceptTOS,
  Cache:      autocert.DirCache("/autotlscache"),
  HostPolicy: autocert.HostWhitelist("mydomain.com"),
}

s := http.Server{
  Addr:    ":443",
  Handler: server,
  TLSConfig: &tls.Config{
    // only allow ECDSA certificates
    CipherSuites: []uint16{
      tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
      tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
      tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
    },
    GetCertificate: autoTLSManager.GetCertificate,
    NextProtos:     []string{acme.ALPNProto},
  },
  ReadTimeout: 5 * time.Second,
}

server.Logger.Fatal(s.ListenAndServeTLS("", ""))