**Key Length**

* A general purpose Root CA should never be larger than 2048 bits.  Reason: MSFT Support sees many cases where [Java apps or network devices only support key sizes of 2048 bytes][1].  Save the higher bit lengths to CAs that are constrained for a specific purpose (Windows vs Network devices) etc.

**Choosing a Hash**

* Windows 2003 and [XP clients may need a patch for SHA2 Algorithms][2] which include SHA256, SHA384, and SHA512.

* Authenticode and S/MIME with SHA2 hashing is not supported on XP or 2003

**High Security/Suite B Deployments**

Here is [information regarding the Suite B algorithms supported in Windows 2008 and R2][3]


    ALGORITHM                                          SECRET           TOP SECRET

    Encryption:
    Advanced Standard (AES)                            128 bits         256 bits

    Digital Signature:
    Elliptic Curve Digital Signature Algorithm (ECDSA) 256 bit curve.	384 bit curve

    Key Exchange:
    Elliptic Curve Diffie-Hellman (ECDH)               256 bit curve.	384 bit curve

    Hashing:
    Secure Hash Algorithm (SHA)	                       SHA-256           SHA-384

 

For Suite B compliance, the `ECDSA_P384#Microsoft Software Key Service Provider` as well as the `384` key size and `SHA384` as the hash algorithm may also be selected if the level of classification desired is Top Secret.  The settings that correspond with the required level of classification should be used. `ECDSA_P521` is also available as an option.  While the use of a 521 bit ECC curve may exceed the cryptographic requirements of Suite B, due to the non-standard key size, 521 is not part of the official Suite B specification.
 

Finally one should know that installing AD Certificate Services isn't as simple as adding the role.  The file [CAPolicy.inf][4] should be edited as needed for your environment 


  [1]: http://blogs.technet.com/b/askds/archive/2009/10/15/windows-server-2008-r2-capolicy-inf-syntax.aspx
  [2]: http://support.microsoft.com/kb/968730
  [3]: http://www.microsoft.com/en-us/download/details.aspx?id=14551
  [4]: http://technet.microsoft.com/en-us/library/cc756120.aspx