CSR generation always defaults to P256 curve due to missing parameter

[trc-ikeskin]

CSR generation always defaults to P256 curve due to missing parameter

[SpectralHiss]

Thanks for reporting this @trc-ikeskin!
I don't see any reason not to do this and it should be a relatively straightforward fix.
I will raise a tentative PR to address this issue in the coming days.

[SpectralHiss]

I think the reason this was not initially supported is that on the release of Istio 1.6 where ECC was introduced, only P256 was supported, but I can see now that P384 + P256 are both supported
This was introduced about 10 months ago in this PR

We will enable this key size option for both the Istiod cert and istio-csr's own server cert (which is the one your error comes from).
You'd still need to set the Istio installation configuration as show in the documentation here if you want all workload identities to use the same algorithm as we cannot override the incoming CSRs.

[trc-ikeskin]

@SpectralHiss you are absolutely right. Shortly after opening this issue I found the PR myself.
Thank you for the heads up and your work on this!

[SpectralHiss]

@trc-ikeskin try this now and see if it works, you can find an example helm chart + istio install here