a month ago
Hi team,
My custom domain ocpp.voltpay.cl (service "OCPP WSS & API", project voltpay) is served by Railway's edge and is presenting an ECDSA certificate. Your documentation states custom domains are issued RSA 2048-bit Let's Encrypt certificates, so this looks inconsistent.
Verified from a clean client (antivirus TLS interception disabled):
CNAME: ocpp.voltpay.cl → u3zdtw1w.up.railway.app (69.46.46.96)
Issuer: CN=YE2, O=Let's Encrypt, C=US
Subject: CN=ocpp.voltpay.cl
Public key: ECC, Signature: sha384ECDSA
Negotiated TLS 1.2 is supported (good), but the leaf is ECDSA-only.
Impact: I connect embedded IoT devices (EV chargers using OCPP over WSS) whose TLS stacks are RSA-only, TLS 1.2. Against an ECDSA-only certificate there is no shared cipher suite, so the TLS handshake fails. The same chargers connect fine to other WSS endpoints that serve RSA certificates.
Request: Can you issue/serve an RSA 2048 certificate for ocpp.voltpay.cl (as your docs describe), or enable a dual RSA+ECDSA setup so RSA-only clients can negotiate? If there's no way to force RSA on the edge, please confirm so I can move to terminating TLS myself via TCP Proxy.
Thanks!
1 Replies
a month ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • about 1 month ago
a month ago
The docs are outdated.
ECDSA certificates are issued instead of RSA.
You can issue custom certificates with Cloudflare's Advanced Certificate Manager.