OpenBSD relayd(8) adds ECDSA support with CA engine code from smtpd(8)

Contributed by Peter N. M. Hansteen on 2026-07-21 from the relay my ECDSA to me dept.

Up until quite recently, relayd(8) did not actually support ECDSA keys and certificates, as described in the Relayd doesn't like ecdsa thread on the tech@ mailing list.

The problem is now solved.

In this commit by Rafael Sadowski (rsadowski@), code that originated in smtpd(8) adds the previously lacking support.

The commit message reads,

List:       openbsd-cvs
Subject:    CVS: cvs.openbsd.org: src
From:       Rafael Sadowski <rsadowski () cvs ! openbsd ! org>>
Date:       2026-07-20 17:41:07
Message-ID: 17bfa7826d307ce0 () cvs ! openbsd ! org

CVSROOT:	/cvs
Module name:	src
Changes by:	rsadowski@cvs.openbsd.org	2026/07/20 11:41:07

Modified files:
	usr.sbin/relayd: ca.c relay.c relayd.h ssl.c

Log message:
relayd: add ECDSA support to the CA privsep engine

Add an EC_KEY_METHOD that forwards the sign operation to the CA process,
clone the existing RSA engine. ssl_load_pkey() now handles both RSA
and EC keys and attaches the cert hash accordingly.

The engine and signing code was migrated from smtpd from (op@) with
some tweaks by me.

OK op@

This means those odd errors should now be history, at least for those of us running -current or fresh snapshots.

As always, please do test if you are able. The developers will appreciate reports on any anomalies.

Latest Articles

Tue, Aug 11
- 11:36 OpenSSH 10.5 released (1)
Fri, Aug 07
- 06:14 OpenBGPD 9.2 released (0)
Wed, Aug 05
- 08:38 Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8) (0)
Tue, Aug 04
- 05:42 Call for testing: OpenBSD vmm(4)/vmd(8) fd-ification (0)
Thu, Jul 30
- 13:03 LLVM toolchain coming to OpenBSD/sparc64 (0)
Sat, Jul 25
- 10:36 httpd(8) gains support for custom HTTP headers (0)
Tue, Jul 21
- 12:47 OpenBSD relayd(8) adds ECDSA support with CA engine code from smtpd(8) (0)
- 10:21 Game of Trees 0.127 released (0)
Sun, Jul 19
- 09:38 WPA3 support coming to OpenBSD (0)

Credits

Copyright © 2004-2008 Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to April 2nd 2004 as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]