Take the 2-minute tour ×

Is it possible to have multiple key lengths in a PKI? For example, use a 1024-bit key for the issued certificate, a 2048-bit key for the intermediate certificate, and 4096-bit key for the root certificate? I don't know a lot about PKI, but does this make sense?

share|improve this question
add comment

1 Answer

Yes, each certificate stands on its own, and can be any bit length without any connection to the length of certificates which it signs or which have signed it.

And yes, it may make more sense to have a root certificate, which is used rarely but requires more security, be a longer key length than a web server certificate, which is used often and where the computational speed has an impact.

share|improve this answer
Exactly, and different cert types under a CA can have different lengths - say a high-use, low risk app gets a small key, and a low-use, high risk app needs a bigger key - most CAs let you set up multiple profiles, and the user picks the type of cert they need. –  bethlakshmi Sep 19 '12 at 18:37
add comment

Your Answer


