Certificate Chain Size Calculator for TLS

Having strong encryption on your key are essential for a secure connection. Back in the day, bigger was better, so the industry ran after bigger keys. Then along came elliptic curve cryptography with its fast handshake and small signature, so everyone moved to ECC to get the latency and space benefits.

But no one checked out the chain. Having a small leaf certificate doesn’t help when you bundle it up with too many redundant intermediates and extensions. But this is where the problem lies: size of a certifcate isnt only determined by the algorithm. It’s also determined by what else you want to include along for the ride.

How to Make Your Certificate Smaller

When you provision an IoT device or web server you don’t just send them a public key. You send them a proof of identity wrapped in ASN.1 structures, padded with Subject Alternative Names and filled with Authority Information Access URLs.

Once you know what your chain profile is, you can plug it into the calculator above. It do all the math for you, so you don’t have to guess how many more packets those long OCSP responders will cost you.

For example, think about what it means to have just a plain old cert vs. It are a fully provisioned cert ready for use. For P-256 curves, that’s about seven-hundred bytes of raw key material. Sounds small, right? But now you tack on an additional few byte per DNS name if you’re using multiple domains. Then the size doubles from those two Certificate Transparency logs needed to meet browser requirements plus your issuer’s CA URL.

And then there are the intermediate certs, most admins only pay attention to leaf and forget about the envelope.

There’s an additional wrinkle that most folks aren’t aware of: the encoding. When we’re actually performing the TLS handshake, the DER format is used, which is compact. For backup purposes and when configuring certificates, we use the PEM format, which is just a text format in base64. Because it takes 3 bytes of binary data to produce 4 printable characters (plus some overhead), base64 add roughly one-third overhead. That third makes a difference if you have limited flash memory on your device where you’re storing the certs.

The tool on this page will let you switch back and forth from one format to another to see how much you save in network transfer different than storage. Or perhaps we should talk about packet fragmentation? That’s because Ethernet frame sizes is limited. If your certificate flight doesn’t fit in one payload, then it gets split across several TCP packets, each of which takes a round trip to arrive. You don’t notice this delay much when you’re on a fast local network, but you certainly do on a congested mobile network, or over a satellite link. It take longer.

A long RSA chain; for example, one with two intermediates… Break into pieces while a tight Ed25519 chain does not. So you’re getting more bang for your buck by way of more bytes but less by way of delay.

Finally, many organizations adds the root certificate to the end of their chain bundle as a matter of habit, which; with few exceptions (is almost always wrong for public TLS). Sending the root certificate wastes bytes on each and every handshake when clients already trust the root! In contrast, private PKI deployments are different: if your clients don’t have the root installed then you need to send it. The calculator let you toggle this setting, since the rules on the public internet and in internal networks differs.

And then there’s extensions, where certificates gets out of hand. There’s no limit on the number of Subject Alternative Names that you can put into a cert, and some admins include a dozen or more internal hostnames in their certs for ease of management. Every one of these names adds bytes. Your Policy OID adds bytes too. Each additional URL add bytes. Is it worth making certificate management easier if it means longer certificate handshakes for all your users? Sometimes yes, sometimes no, you’ll need to choose.

So you want to make your cert tiny. As tiny as possible? No. As tiny as needed. How do we know when it’s “just right?” It is just right when it’s tiny enough for the auditors and the clients is happy with it. You should of made it small. If your root is public, remove it from the chain. Remove extra extensions and convert to ECC if compatible.

Next, validate that your optimizations realy did shrink the packets. Size isn’t just about numbers; it’s about making things efficient.