我希望我的移动客户端使用较less的CPU能力，并使用较less的networking带宽，因此希望为Azure移动应用程序使用ECC证书
如何生成基于ECC的证书以用于Azure Mobile？
根本不需要OpenSSL。 如果您可以使用Microsoft CA，请使用它来请求证书（通过证书MMCpipe理单元）。 要使用外部CA，可以使用certreq.exe工具创build证书请求。 创build以下INF模板：
[NewRequest] Subject="CN=<subject>" KeyAlgorithm=ECDH_secP384r1 ProviderName="Microsoft Software Key Storage Provider" KeyLength=384 Exportable=True MachineKeySet=false KeyUsage=0xa0 [EnhancedKeyUsageExtension] OID=1.3.6.1.5.5.7.3.1 ; Server Authentication OID=1.3.6.1.5.5.7.3.2 ; Client Authentication
并运行命令：
certreq -new path\inffile.inf path\outrequest.req
输出请求文件可以提交给CA服务器。
或者，您可以使用New-SelfSignedCertificate PowerShell cmdlet创build自签名证书。 语法是这样的：
New-SelfSignedCertificate -Subject "CN=<Subject>" ` -KeyAlgorithm ECDH_secP384r1 ` -CertStoreLocation cert:\currentuser\my ` -KeyExportPolicy Exportable ` -Type SSLServerAuthentication <...>
根据需要提供其他参数。
要生成ECC密钥，您需要使用OpenSSL。 此时，MSFT在Web应用程序中不支持此位长度。
创build此证书的过程是：
validhost:~ lamont$ openssl ecparam -genkey -name secp384r1 | openssl ec -out ec384.key read EC key writing EC key validhost:~ lamont$ openssl req -new -key ec384.key -out ec384.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:California Locality Name (eg, city) []:San Francisco Organization Name (eg, company) [Internet Widgits Pty Ltd]:VALID LLC Organizational Unit Name (eg, section) []:Technology Common Name (eg server FQDN or YOUR name) []:moonlight.social Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: validhost:~ lamont$ cat ec384.csr
取出CSR的输出并获得签名证书。 然后运行以下命令将文件转换为与Azure兼容的PFX …：
openssl pkcs12 -export -out your_pfx_certificate.pfx -inkey your_private.key -in your_pem_certificate.crt -certfile CA-bundle.crt