Is there an RFC that covers cert size limits

Issuance Policy
1

Is there an RFC that covers cert size limits?

  • particularly maximum names allowed in a SAN.
  • overall Byte size of the cert file.

Follow up question:
Are there any particular products known to have issues with larger than normal certs?

1 Like
2

I don’t know if there’s an RFC but see eg this and this

(and I know you’re aware of this, but since you posted in Issuance Policy I should point out that LE has a limit of 100 SANs per cert)

2 Likes
3

I believe TLS has a max field size of 2**24 bytes. Pretty big! I think that is the only standards-imposed limit. The reason for Let’s Encrypt’s max is practical. The certificate has to be downloaded on every handshake, so big certificates slow down web sites, possibly making them unavailable on slow or flaky connections. Also, managing information for a large number of SANs is cumbersome.

3 Likes
4

@jsha 2^24 is an extremely huge limit !
Thinking more realistically… as within the LE limit confines.
100 SAN entries with each limited to a max 255 bytes + (cert & chain) = ~32K
Thus the reason for my second question.
Which I will now restate these ways:
Are there any know issues with using a cert that is >10K, >20K, or >30K bytes?
If greater, then, at which size do actual Internet connected things start to break?
(I’m pretty sure a 2GB cert will break everything that tries to load it)

1 Like
5

https://badssl.com/ has a couple large certificates:

IIRC, some popular web browsers and HTTPS libraries reject the latter.

3 Likes
6

@mnordhoff but are they rejected because of the size of the file or the number of SAN entries?

1 Like
7

"A traffic jam when you're already late / A no-smoking sign on your cigarette break / It's like ten thousand SANs, when all you need is a knife..." :musical_note:

5 Likes
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.