Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

Is it possible to have multiple key lengths in a PKI? For example, use a 1024-bit key for the issued certificate, a 2048-bit key for the intermediate certificate, and 4096-bit key for the root certificate? I don't know a lot about PKI, but does this make sense?

share|improve this question

1 Answer

up vote 8 down vote

Yes, each certificate stands on its own, and can be any bit length without any connection to the length of certificates which it signs or which have signed it.

And yes, it may make more sense to have a root certificate, which is used rarely but requires more security, be a longer key length than a web server certificate, which is used often and where the computational speed has an impact.

share|improve this answer
1  
Exactly, and different cert types under a CA can have different lengths - say a high-use, low risk app gets a small key, and a low-use, high risk app needs a bigger key - most CAs let you set up multiple profiles, and the user picks the type of cert they need. – bethlakshmi Sep 19 '12 at 18:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.