Are there any disadvantages to using a 4096-bit encrypted SSL certificate?

Question

I was recently requesting a SSL cert via GoDaddy and noticed this message:

Answer 1

If you are going to use Amazon CloudFront, they only supports up to 2048 bit keys as of today.

References:

• Having trouble associated SSL cert with Amazon Cloudfront
• SSL certs with keys larger than 2048 bits?

Answer 2

Pretty much all* browsers will support 4096-bit keys. The issue you'll run into is that key exchange is slower with larger keys, which will increase load on the server and slow down page loading on the client.

2048-bit keys are generally considered safe for the time being. If you want an intermediate step, though, 3072-bit keys are right smack-dab in the middle.

*: Only exception might be a couple of weird, old mobile / embedded browsers.

Answer 3

If you have a 4096 bit SSL certificate, in order to support some clients (especially Java-based clients and some older clients) you will want to generate a 2048 bit or 1024 bit Diffie-Hellman Key and add it to your server certificate. However, if you support a 1024 bit DH key you should also be aware of the Logjam attack. You can accommodate these clients easily by adding a DH key of the appropriate size, but first carefully consider which clients you want to support.

Answer 4

Hi sorry for answering SOOO OLD thread, but the main point in "NOT" creating 4096 cert is, your CA cert will be 2048, so creating sub cert 4096 is pointless... when even having 2049 bit long cert will make attacker attack your CA cert instead yours.