Code Signing Certificates: Stronger Security with 3072- or 4096-bit RSA Keys
-
Modern publicly trusted Code Signing Certificates using RSA must meet strong cryptographic requirements. The CA/Browser Forum requires a minimum RSA key size of 3072 bits, a standard that has been in place since 2021. Code Signing certificates allow developers and software publishers to digitally sign applications, executables, scripts, drivers, and software updates. The signature helps users verify the publisher and confirms that the signed code has not been modified after signing.
For RSA-based Code Signing certificates offered through GoGetSSL, the 3072 and 4096 bit keys are currently accepted. Both key sizes meet or exceed the current industry minimum. A larger RSA key increases the computational effort required to attack the underlying cryptography, helping provide strong protection for software signatures.
-
-
*
About Key Length
Key length describes the size of a cryptographic key, measured in bits.
In Code Signing, the private key is used to create a digital signature, while the corresponding public key allows systems to verify that signature.
RSA key size is directly related to cryptographic strength. According to the National Institute of Standards and Technology (NIST), a 2048-bit RSA key provides approximately 112 bits of security, while a 3072-bit RSA key provides approximately 128 bits of security.
Increasing the RSA key size makes attacks against the cryptographic key significantly more computationally demanding and helps strengthen the long-term security of software signatures.
However, key length is only one part of Code Signing security. Protecting the private key itself is equally important because anyone who gains access to it could potentially create fraudulent signatures.
-
*
Change in RSA Key Size
RSA key-size requirements have increased over time as computing capabilities and cryptographic security standards have evolved.
Older certificates once used 1024-bit RSA keys, but these were eventually replaced by stronger 2048-bit keys.
NIST later recommended 3072-bit RSA as the key size corresponding to approximately 128 bits of security in its SP 800-57 Part 1 Revision 5 guidance.
The CA/Browser Forum incorporated stronger RSA requirements into its Code Signing Baseline Requirements. Since June 1, 2021, publicly trusted Code Signing certificates using RSA must have a modulus of at least 3072 bits.
The current requirements also permit approved alternatives such as Elliptic Curve Digital Signature Algorithm (ECDSA) keys using NIST P-256, P-384, or P-521 curves.
-
*
How to Find the RSA Key Size in a Code Signing Certificate
On Windows, you can inspect the certificate attached to a digitally signed executable and check its public-key size.
The exact interface may vary slightly depending on your Windows version, but the process is generally:
- Locate the signed .exe file.
- Right-click the file and select Properties.
- Open the Digital Signatures tab.
- Select the relevant signature and click Details.
- Select View Certificate.
- Open the Details tab.
- Locate the Public Key field.
The certificate details should indicate the public-key algorithm and, for RSA certificates, the key size.
For example, an RSA-based certificate may show a 3072-bit public key.
Note: If you encounter a historical signature that uses a 2048-bit RSA certificate, this does not automatically make the old signature invalid. However, current publicly trusted RSA Code Signing certificates must meet the newer minimum 3072-bit requirement.
-
*
Conclusion
The move from 2048-bit to 3072-bit RSA keys was an important step in strengthening publicly trusted Code Signing certificates.
A 3072-bit RSA key provides a higher cryptographic security level and meets the current CA/Browser Forum minimum requirement for RSA-based Code Signing certificates.
For software developers and publishers, however, secure Code Signing involves more than key length. Strong RSA or ECDSA keys, secure private-key storage, proper certificate validation, and trusted timestamping all contribute to protecting software integrity and maintaining user trust.
Organizations that need to sign software, applications, executables, or updates can choose from the current Code Signing Certificate options available through GoGetSSL.
-
