Certificate formats · 19.4
Key types: RSA and ECDSA
| RSA | ECDSA | |
|---|---|---|
| Key sizes in TLSPilot | RSA 2048, 3072, 4096 | ECDSA P-256, P-384, P-521 (P-521 only for the Private CA) |
| Size and speed | Large keys and signatures, slower handshake | Small keys and signatures, fast handshake |
| Compatibility | Accepted by every target | Not accepted by every target, for example Azure Front Door |
| PEM key formats | PKCS #8, PKCS #1, Encrypted PEM | PKCS #8, Encrypted PEM; PKCS #1 is not possible |
| Default in TLSPilot | Enterprise CA (always RSA), Private CA (RSA 3072) | ACME, if no key algorithm is selected (P-256) |
Which sizes are available depends on the issuer: ACME providers list only the algorithms they support, for example Let’s Encrypt up to P-384 and ZeroSSL RSA 2048, RSA 4096 and P-256. The key type is fixed when the certificate is issued. To change it, change the key algorithm of the certificate (ACME: Key algorithm on the tab Settings, see chapter ACME settings; Private CA: Leaf key algorithm) and renew. If a target needs PKCS #1, the certificate must have an RSA key: for an ECDSA key, TLSPilot disables PKCS #1 (PEM RSA) and shows PKCS#1 requires RSA.