RSA bit size Compatibility in a Two-Tier PKI.

Question

Hi,

Can Root CA RSA be 4096bits but the Issuing CAs be 2048bit or vice versa.

A similar question about Web Server user/machine certs with 2048bit RSA where the Issuing CA is set to 4096.

Just want to make sure different size RSAs in the environment cant cause issues.

Answer 1

Hello @Sam Na

This article can give you a better idea when choosing your setting size as well as how to avoid further troubles. See below:

https://datatracker.ietf.org/doc/rfc8017/

Regards

Answer 2

Can Root CA RSA be 4096bits but the Issuing CAs be 2048bit or vice versa.

yes

A similar question about Web Server user/machine certs with 2048bit RSA where the Issuing CA is set to 4096.

yes

Just want to make sure different size RSAs in the environment cant cause issues.

in most cases there should not be issues. However issues may arise if some legacy or badly written custom application doesn't support 4k RSA key.