Solved

Reducing the size of certificate chain

Posted on 2016-10-05
2
62 Views
Last Modified: 2016-10-14
HI,
Following is a capture of wireshark :
 Screen-Shot-2016-10-05-at-5.22.43-PM.pngHere there are 3 certificates and the size is : 4310 bytes
Here are the certificates as i see in chrome :

Screen-Shot-2016-10-05-at-5.22.54-PM.png
I read up the following rule for optimization of certificates :
Ideally, your sent certificate chain should contain exactly two certificates and A carefully managed certificate chain can be as low as 2 or 3 KB in size

But the certificate chain for my site exceeds 4 KB.
Please suggest any approach to lower this down.. I think i will have to somehow get away with the intermediate certificate..

Thanks
0
Comment
Question by:Rohit Bajaj
2 Comments
 
LVL 14

Assisted Solution

by:Schnell Solutions
Schnell Solutions earned 150 total points
ID: 41829973
If that is the chain of one specific certificate you cannot change it. What you can do is to use a 'different' certificate that uses a shorter chain. However, it means re-issue a new certificate and complete the entire process to implement the new one.

On another hand you will not wish to set one intermediate certificate as a root ca to shorten the path in your server as far as it would be a very bad security practice.
0
 
LVL 23

Accepted Solution

by:
Dirk Kotte earned 350 total points
ID: 41830172
your book are from 2013. Last years we double the certificate length and nearly every CA add some sub-CAs.
The statement: "which will overflow the initial congestion windows size of older servers ..." is not current.

Using a certificate with fewer intermediate chains and / or a smaller public key size can reduce the amount of data but is not an option today ...mostly...
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
Use Wufoo, an online form creation tool, to make powerful forms. Learn how to choose which pages of your form are visible to your users based on their inputs. The page rules feature provides you with an opportunity to create if:then statements for y…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now