• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 300
  • Last Modified:

Reducing the size of certificate chain

HI,
Following is a capture of wireshark :
 Screen-Shot-2016-10-05-at-5.22.43-PM.pngHere there are 3 certificates and the size is : 4310 bytes
Here are the certificates as i see in chrome :

Screen-Shot-2016-10-05-at-5.22.54-PM.png
I read up the following rule for optimization of certificates :
Ideally, your sent certificate chain should contain exactly two certificates and A carefully managed certificate chain can be as low as 2 or 3 KB in size

But the certificate chain for my site exceeds 4 KB.
Please suggest any approach to lower this down.. I think i will have to somehow get away with the intermediate certificate..

Thanks
0
Rohit Bajaj
Asked:
Rohit Bajaj
2 Solutions
 
Schnell SolutionsSystems Infrastructure EngineerCommented:
If that is the chain of one specific certificate you cannot change it. What you can do is to use a 'different' certificate that uses a shorter chain. However, it means re-issue a new certificate and complete the entire process to implement the new one.

On another hand you will not wish to set one intermediate certificate as a root ca to shorten the path in your server as far as it would be a very bad security practice.
0
 
Dirk KotteSECommented:
your book are from 2013. Last years we double the certificate length and nearly every CA add some sub-CAs.
The statement: "which will overflow the initial congestion windows size of older servers ..." is not current.

Using a certificate with fewer intermediate chains and / or a smaller public key size can reduce the amount of data but is not an option today ...mostly...
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now