Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to have multiple key lengths in a PKI? For example, use a 1024-bit key for the issued certificate, a 2048-bit key for the intermediate certificate, and 4096-bit key for the root certificate? I don't know a lot about PKI, but does this make sense?

share|improve this question

Yes, each certificate stands on its own, and can be any bit length without any connection to the length of certificates which it signs or which have signed it.

And yes, it may make more sense to have a root certificate, which is used rarely but requires more security, be a longer key length than a web server certificate, which is used often and where the computational speed has an impact.

share|improve this answer
Exactly, and different cert types under a CA can have different lengths - say a high-use, low risk app gets a small key, and a low-use, high risk app needs a bigger key - most CAs let you set up multiple profiles, and the user picks the type of cert they need. – bethlakshmi Sep 19 '12 at 18:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.