Key Size Requirements for Code Signing Certificates: RSA 3072, 4096, and ECC
-
Code signing certificates need stronger keys than SSL certificates: RSA keys must be at least 3072 bits long. Here's what the requirement means, how RSA 3072 and RSA 4096 compare, and where ECC fits in.
-
-
*
Minimum Key Size for Code Signing
Since June 1, 2021, the CA/Browser Forum Baseline Requirements for code signing set a minimum RSA key size of 3072 bits. This applies to all publicly trusted code signing certificates, OV and EV alike, and certificate authorities can't make exceptions. A certificate with a 2048-bit RSA key can no longer be issued, renewed, or reissued.
The bar is higher than for SSL certificates because code signatures last longer. Thanks to timestamping, software signed today can stay trusted for many years after the certificate expires, so the key behind the signature needs to stay secure for just as long. See Timestamping: Why Digital Signatures Need Timestamps .
-
*
RSA 3072 vs. RSA 4096
Both key sizes meet the requirement and are accepted by DigiCert and Sectigo. The differences are practical rather than critical:
- Security. RSA 3072 meets the security level that NIST recommends for use after 2030. RSA 4096 adds an extra margin on top of that.
- Speed. Signing with a 4096-bit key takes a little longer. Since you sign once per release, the difference is rarely noticeable.
- Hardware support. Your private key is generated on a token or HSM, and not every device supports 4096-bit keys. RSA 3072 is supported more widely.
Tip: RSA 3072 is enough for most publishers. Choose RSA 4096 if your security policy requires it or you want the extra margin, and make sure your token or HSM supports it.
-
*
What About ECC?
ECC (Elliptic Curve Cryptography) keys are an alternative to RSA. The 2021 change didn't affect them, and code signing certificates can still be issued with ECC keys on the P-256 and P-384 curves. ECC offers the same level of security with much smaller keys, but older platforms and some signing tools have limited ECC support, so check compatibility before switching. For more on how the two algorithms differ, see ECC, RSA, and SHA in SSL Certificates.
-
*
Why You May See "4096-bit" Everywhere
New root certificates for code signing and timestamping must use 4096-bit RSA keys, so CAs have moved their code signing hierarchies to RSA 4096. This applies to the CA's own certificates, not to yours. Your code signing certificate only needs a key of at least 3072 bits.
-
*
Key Size and Hardware Storage
Since June 2023, the private key for any code signing certificate must be generated and stored in secure hardware, such as a USB token, an HSM, or a cloud HSM. See Code Signing 2023 Industry Changes. The key size is set when the key is created on the device and can't be changed later, short of generating a new key and reissuing the certificate.
Important: Check which key sizes your token or HSM supports before generating the key. When you reissue or renew the certificate, the new key must also be at least RSA 3072.
-
