As part of the 11.6.3 release, support for Cipher Suites using Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) has been added for the following key exchanges, which is a significant improvement on the existing cipher availability:

• ECDHE-RSA-AES256-GCM-SHA384
• ECDHE-RSA-AES256-SHA384
• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-AES128-SHA256

With these changes, it's now possible to use Elliptic Curve (EC) keys. But, changing a Receiver certificate to use an EC key implies that all encrypted connections to that Receiver must use EC keys. By doing so, backward compatibility might be lost, causing data collection interruption for customers.

Perform the following steps:

1. To enable EC keys: 
   1. ssh to the receiver as root.
   2. Create a directory to backup the current configuration using the following command:
      mkdir /root/SSLBackup
       
   3. Backup the existing certificate and key using the command below:
      cp -a /etc/NitroGuard/SSL.* /root/SSLBackup/
       
   4. Backup the certificate creation script using the command below:
      cp -a /usr/local/bin/nasgencrt /root/SSLBackup/
       
   5. Edit the certificate creation script to create EC keys:
      sed -i 's/rsa:$req_bits/ec -pkeyopt ec_paramgen_curve:secp521r1/g' /usr/local/bin/nasgencrt
       
   6. Execute the certificate creation script:
      /usr/local/bin/nasgencrt
       
   7. Finally, restart all collectors or reboot the Receiver.
       

2. To return to RSA keys:
   1. Restore your backup certificate creation script using the following command:
      cp -a /root/SSLBackup/nasgencrt /usr/local/bin/nasgencrt
       
   2. Restore your backup SSL certificates using the command below:
      cp -a /root/SSLBackup/SSL.* /etc/NitroGuard/

NOTE: The above steps don't need to be completed on all Receivers, only ones where you wish to change to exclusively using EC key-based ciphers.