TL;DR — Quick Summary

Choose the right RSA or ECC key length for SSL/TLS certificates based on NIST. Compare 2048, 3072, 4096 RSA vs P-256, P-384 ECC performance.

Choosing the Right Key Length

When generating an SSL/TLS certificate, you choose a key length (RSA) or curve (ECC). Larger keys are more secure but slower. Here’s how to decide.

RSA Key Size Comparison

Key Size Security Level NIST Status Handshake Speed Recommended For
1024-bit Broken ❌ Disallowed since 2013 Fastest Nothing — insecure
2048-bit 112-bit ✅ Acceptable through 2030 Fast Standard web certificates
3072-bit 128-bit ✅ Recommended Moderate Higher security needs
4096-bit ~140-bit ✅ Strong Slower (4-6x vs 2048) CA roots, code signing, long-lived keys
8192-bit ~190-bit ✅ Very strong Very slow Extreme security requirements

RSA vs ECC Equivalent Security

Security Level RSA Key Size ECC Curve Certificate Size Handshake Speed
112-bit 2048 — 1-2 KB Baseline
128-bit 3072 P-256 300 bytes (ECC) ECC 10x faster
192-bit 7680 P-384 400 bytes (ECC) ECC 20x faster
256-bit 15360 P-521 500 bytes (ECC) ECC 30x faster

Quick Recommendation

Use Case Recommendation Why
Standard website ECC P-256 or RSA 2048 Good security, best compatibility
E-commerce / financial ECC P-384 or RSA 3072 Higher assurance
CA / root certificate RSA 4096 or ECC P-384 Long-lived, needs extra margin
Internal / test RSA 2048 Simple, fast
Post-quantum preparation Hybrid certificates Watch NIST PQC standards

How to Generate Keys

# RSA 2048
openssl genrsa -out key.pem 2048

# RSA 4096
openssl genrsa -out key.pem 4096

# ECC P-256 (recommended)
openssl ecparam -genkey -name prime256v1 -out key.pem

# ECC P-384
openssl ecparam -genkey -name secp384r1 -out key.pem

Summary

  • 2048 RSA is the minimum — secure through 2030 per NIST.
  • ECC P-256 provides equivalent security to RSA 3072 but is 10x faster.
  • 4096 RSA for CA roots and long-lived keys.
  • ECC is the future — smaller, faster, and equally secure.