TL;DR — Quick Summary

Choose the right RSA or ECC key length for SSL/TLS certificates based on NIST recommendations. Compare 2048, 3072, 4096 RSA and P-256, P-384 ECC for security, performance, and compatibility.

Choosing the Right Key Length

When generating an SSL/TLS certificate, you choose a key length (RSA) or curve (ECC). Larger keys are more secure but slower. Here’s how to decide.

RSA Key Size Comparison

Key SizeSecurity LevelNIST StatusHandshake SpeedRecommended For
1024-bitBroken❌ Disallowed since 2013FastestNothing — insecure
2048-bit112-bit✅ Acceptable through 2030FastStandard web certificates
3072-bit128-bit✅ RecommendedModerateHigher security needs
4096-bit~140-bit✅ StrongSlower (4-6x vs 2048)CA roots, code signing, long-lived keys
8192-bit~190-bit✅ Very strongVery slowExtreme security requirements

RSA vs ECC Equivalent Security

Security LevelRSA Key SizeECC CurveCertificate SizeHandshake Speed
112-bit2048—1-2 KBBaseline
128-bit3072P-256300 bytes (ECC)ECC 10x faster
192-bit7680P-384400 bytes (ECC)ECC 20x faster
256-bit15360P-521500 bytes (ECC)ECC 30x faster

Quick Recommendation

Use CaseRecommendationWhy
Standard websiteECC P-256 or RSA 2048Good security, best compatibility
E-commerce / financialECC P-384 or RSA 3072Higher assurance
CA / root certificateRSA 4096 or ECC P-384Long-lived, needs extra margin
Internal / testRSA 2048Simple, fast
Post-quantum preparationHybrid certificatesWatch NIST PQC standards

How to Generate Keys

# RSA 2048
openssl genrsa -out key.pem 2048

# RSA 4096
openssl genrsa -out key.pem 4096

# ECC P-256 (recommended)
openssl ecparam -genkey -name prime256v1 -out key.pem

# ECC P-384
openssl ecparam -genkey -name secp384r1 -out key.pem

Summary

  • 2048 RSA is the minimum — secure through 2030 per NIST.
  • ECC P-256 provides equivalent security to RSA 3072 but is 10x faster.
  • 4096 RSA for CA roots and long-lived keys.
  • ECC is the future — smaller, faster, and equally secure.