We are using a Self-signed certificate for our SSO with 2048 key size (which we are generating from Salesforce). I understand that this will only last one year. If we switch to 4096 key size, what would be the implications?
Many services do not support 4096-bit keys. A web search came across So you're making an RSA key for an SSL certificate. What key size do you use?, where the author explains the primary differences between the two.
It basically comes down to speed, security, and compatibility. Many platforms are not compatible with 4096-bit keys, using 4096-bit keys will slightly increase the login time, and most feel that the extra security is not currently worth it (including major players like Amazon), since you're just going to be cycling certificates anyways.
Basically, you can either continue to use 2048-bit keys that are known compatible with all major systems, or you can spend a bunch of time researching if all the systems involved will even support 4096-bit keys just for the added convenience of another year of certificate service.