openssl genrsa -out server.key 1024
openssl req -new -key server.key -out server.csr
"CA step here", generates server.crt, at least 2048 bit RSA

Can we use this two commands to create a server.pem file in the end?

Or the webbrowsers, general softwares will surely reject it, because it is not 2048 bit sized?

Or the server.key at the first step doesn't matters that it is 1024 bit sizes?

1 Answer 1


Certificates and Certificate Authorities with keys smaller than 2048 bits are not a good choice for new deployments. Unless you have a very specific need for this with some very old hardware or software, there is typically very little impact using a 2048-bit or higher key.

If performance is a concern, and especially on embedded/mobile/low power devices, consider using Elliptic-Curve keys instead of RSA. There are some good guides on how to achieve this.

Mozilla has already started plans to warn users of small RSA key lengths in 2015, and warning for CAs using small keys are already popping up in browsers. Warning for the certificates themselves will start appearing in browsers soon. Deploying anything new knowing this is coming up is not advisable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .