Will there be support for a greater key size? We're using 8192 for our issuing CA.

Curious, why would you need bigger sizes at the moment?

Company policy requires this because it's critical infrastructure, and the issuing CA has an expiration of 15 years.

Didn’t catch the error, my bad. Guess the main issue is that you can’t install the CA which has a key size bigger than 4096bits. I’d suggest opening a support ticket. If you have a ticket ID, I’ll happily forward it internally through CTP Slack to see if we get a public statement on it.

Yeah, that sounds great, or create a feature request / bump the ones that are already there. =D

@Jan Tytgat I've opened a support case: 82768594

Did you already get a reply?

Hey Jan, I did 🙂 And yess, this is the own issuing CA of the customer. Response:

We have received an update from the team.

It seems that currently, we are not supporting RSA key size of 8192 and there is no roadmap yet for its support.

Reason being due to serious practical considerations that prevent such large RSA keys from being used. Particularly, the CPU/compute requirements of generating a signature grow faster-than-linear as the key size grows. Just guessing roughly, the number of handshakes a vserver can do per second with an 8K key may well be in range of 1/10th to 1/100th the number with 4K keys.

In case if the requirement is of the security level > 128, NetScaler already supports ECDSA curves with comparable security to RSA > 8K, but with much more practical tradeoff in terms of size and compute efficiency.

Would that work for you?

We invented a new company policy so only windows clients are allowed and we can ignore the chain 🤣

Plan B sounds like a plan

This is the fine line between what CISOs or management expect and what technically makes sense