On Tue, Jun 2, 2020 at 8:33 PM Alexander Bokovoy <abokovoy@redhat.com> wrote:
On ti, 02 kesä 2020, Natxo Asenjo via FreeIPA-users wrote:
>hi,
>
>We have a new realm with rhel 7.8 and a default CA key of 2048 bits.
>
>Recently a question arose to upgrade this to 4096 bits.
>
>According to this blog post
>https://frasertweedale.github.io/blog-redhat/posts/2020-01-28-freeipa-override-ca-key-size.html
>) this should already be possible for new deployments with RHEL 8.1 but is
>it possible to configure the root CA and eventually sub CAs to use the 4096
>bits signing keys? In doing so, do we need to resign all certificates
>already in use?
>
>Is it possible to do this in RHEL 7 or do we need to update the CA hosts to
>8.1 to achieve it?

Dogtag supports custom CA properties for the main CA and you can specify
them in a pki override file when deploying IPA. Not all properties
described in pki_default.cfg(5) make sense for FreeIPA CA deployment so
we limit them (you'll get an error for those in the override file) but
CA key size is configurable in 4.8.0+.

SubCA configuration is hardcoded in Dogtag's source code. They are
always RSA 2048. So there is no way to use 4096 bits signing keys for them.

In FreeIPA 4.8.0+ default CA signing key size is 3072. We found that it
is a good compromise for real world workloads. According to
https://www.keylength.com/, NIST 800-57 Part 1 Rev. 4 recommends 3072
bit RSA keys for keys that are used beyond 2030 for 128 bit strength.


good to know, thanks!

Be aware that internal defaults in certmonger are set to RSA 2048 in
case explicit signing key algorithm and size are missing in the
certificate request.

we use getcert request -g 4096 and -G points currently to rsa so this seems ok.

...
Abusing this thread, is it possible to re-key the root CA with a with a longer key length while keeping the sub CAs and rest of signed certificates or do we need to reissue all certificates for everything?

Thanks for your time.
--
Regards,
natxo