5

We are using a Self-signed certificate for our SSO with 2048 key size (which we are generating from Salesforce). I understand that this will only last one year. If we switch to 4096 key size, what would be the implications?

6

Many services do not support 4096-bit keys. A web search came across So you're making an RSA key for an SSL certificate. What key size do you use?, where the author explains the primary differences between the two.

It basically comes down to speed, security, and compatibility. Many platforms are not compatible with 4096-bit keys, using 4096-bit keys will slightly increase the login time, and most feel that the extra security is not currently worth it (including major players like Amazon), since you're just going to be cycling certificates anyways.

Basically, you can either continue to use 2048-bit keys that are known compatible with all major systems, or you can spend a bunch of time researching if all the systems involved will even support 4096-bit keys just for the added convenience of another year of certificate service.

  • Hi sfdcfox, thank you so much for the link and explanation! This helps me a lot. – Samantha Young Jul 7 '16 at 18:35
  • @SamanthaYoung You're welcome. Just remember to do your research periodically; it's likely that a better form of encryption might become standard as processing power continues to climb. For now, it's probably best to just go with what we already know works. – sfdcfox Jul 7 '16 at 18:37
  • @sfdcfox - I have a question here, are these self-signed certs SHA-1 or SHA-2? How to find out? I didn;t find any documentation from sf reg this, appreciate your help. – Khyber Nov 17 '17 at 13:28
  • @Khyber Up until last year or so, they were SHA1, but should now be SHA256. Any decent key management system should be able to tell you. Download the certificate and check its properties (e.g. in Windows, right-click, choose Properties, and go to the far-right tab to display the certificate information). – sfdcfox Nov 17 '17 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.