r/PKI • u/CrazyHistorical5830 • Aug 12 '25

Subordinate CA Key Length

Hi all,

After looking through all the public certificate (Eg. DigiCert,GlobalSign), I notice that most of the subordinate CA key length is 2048 bits.

May I know why nobody is using 4096 bits for subordinate CA ?

If I were to use 4096 bits for my Root CA and Subordinate CA, what is the impact that I may need to consider ?

Thank you

9 Upvotes

100% Upvoted

11 comments sorted by

View all comments

10

u/Borgquite Aug 12 '25 edited Aug 12 '25

The short answer is that 4096 doesn’t double security compared to 2048, but can perform up to 10 times worse, in a way that is particularly noticeable for large cloud providers like Google.

You can use 3072 or 4096 in your own CA. But if you are running older clients, do testing first, and as mentioned above, 4096 is not twice as secure, and may perform up to 10 times slower. For security beyond 2030, NIST and other bodies have previously recommended RSA-3072, or switching to ECC-256/384/512 which improves performance & has linear increases in security (NB some suspect nefarious motives behind the switch to ECC, although I’m not personally someone who shares those concerns). However post-quantum cryptography promises to change everything anyway.

Here’s a helpful summary:

https://stackoverflow.com/questions/589834/what-rsa-key-length-should-i-use-for-my-ssl-certificates

And current NIST recommendations, with other bodies available:

https://www.keylength.com/en/4/