Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Reducing the size of certificate chain

Posted on 2016-10-05
2
Medium Priority
?
235 Views
Last Modified: 2016-10-14
HI,
Following is a capture of wireshark :
 Screen-Shot-2016-10-05-at-5.22.43-PM.pngHere there are 3 certificates and the size is : 4310 bytes
Here are the certificates as i see in chrome :

Screen-Shot-2016-10-05-at-5.22.54-PM.png
I read up the following rule for optimization of certificates :
Ideally, your sent certificate chain should contain exactly two certificates and A carefully managed certificate chain can be as low as 2 or 3 KB in size

But the certificate chain for my site exceeds 4 KB.
Please suggest any approach to lower this down.. I think i will have to somehow get away with the intermediate certificate..

Thanks
0
Comment
Question by:Rohit Bajaj
2 Comments
 
LVL 14

Assisted Solution

by:Schnell Solutions
Schnell Solutions earned 600 total points
ID: 41829973
If that is the chain of one specific certificate you cannot change it. What you can do is to use a 'different' certificate that uses a shorter chain. However, it means re-issue a new certificate and complete the entire process to implement the new one.

On another hand you will not wish to set one intermediate certificate as a root ca to shorten the path in your server as far as it would be a very bad security practice.
0
 
LVL 24

Accepted Solution

by:
Dirk Kotte earned 1400 total points
ID: 41830172
your book are from 2013. Last years we double the certificate length and nearly every CA add some sub-CAs.
The statement: "which will overflow the initial congestion windows size of older servers ..." is not current.

Using a certificate with fewer intermediate chains and / or a smaller public key size can reduce the amount of data but is not an option today ...mostly...
0

Featured Post

Lessons on Wi-Fi & Recommendations on KRACK

Simplicity and security can be a difficult  balance for any business to tackle. Join us on December 6th for a look at your company's biggest security gap. We will also address the most recent attack, "KRACK" and provide recommendations on how to secure your Wi-Fi network today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you’re involved with your company’s wide area network (WAN), you’ve probably heard about SD-WANs. They’re the “boy wonder” of networking, ostensibly allowing companies to replace expensive MPLS lines with low-cost Internet access. But, are they …
Without even knowing it, most of us are using web applications on a daily basis.  In fact, Gmail and Yahoo email, Twitter, Facebook, and eBay are used by most of us daily—and they are web applications. We generally confuse these web applications to…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Suggested Courses

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question