Microsoft allows a CA to use Cryptography Next Generation (CNG) and [advises of incompatibility issues][1] for clients that do not support this suite.

Here is an image of the default cryptography settings for a 2008 R2 CA.  This machine is a non-domain connected Standalone CA:

![Default Cryptography settings][2]

Here are the installed providers.  The CNG providers are marked with a # sign

![enter image description here][3]


My intent is to have a general-purpose offline Root-CA and then several Intermediate CAs that serve a specific purpose (MSFT-only vs Unix vs SmartCards etc)

What are the ideal settings for a Root Certificate with an expiration of 5, 10, and 15 years?

1. CSP
2. Signing Certificate
3. Key Character Length

Since this is a RootCA, do any of the parameters affect low powered CPU (mobile devices)


  [1]: http://technet.microsoft.com/en-us/library/cc730763%28v=ws.10%29.aspx
  [2]: https://i.sstatic.net/zfU7l.png
  [3]: https://i.sstatic.net/4BTHL.png