Beginning on May 31, 2021, the minimum RSA key size for code signing and EV code signing certificates issued by SSL.com will increase from 2048 to 3072 bits. SSL.com is making this change as part of its continual effort to follow current industry best practices and remain in compliance with all applicable standards, including the CA/Browser forum’s Baseline Requirements for code signing and EV code signing guidelines. Minimum sizes for ECC code signing keys will remain unchanged. SSL.com’s customers can expect the following effects from this change:
- Code signing and EV code signing certificates issued before May 31, 2021 (including those with 2048-bit RSA keys) will continue to work as usual until they expire. So, if you already have a code signing certificate, no action is necessary at the present time.
- eSigner EV code signing certificates will be issued with 3072-bit RSA keys following this change. If you have already enrolled an EV code signing certificate in eSigner, no further action is necessary.
- Because the YubiKey FIPS tokens we use to distribute EV code signing certificates do not support RSA keys larger than 2048 bits, SSL.com will begin issuing ECC EV code signing certificates on YubiKey. Therefore, you should now choose only the ECCP256 or ECCP384 algorithm when generating keys for a new EV code signing certificate on Yubikey, not RSA2048:
- Windows users with YubiKey-installed ECC EV code signing certificates should also install the YubiKey Minidriver to prevent compatibility issues.
YubiKey and RSA key size (updated August 2026)
SSL previously could not issue RSA code signing certificates on YubiKey FIPS tokens with a key size larger than 2048 bits, because older YubiKey firmware did not support RSA keys larger than 2048 bits. For this reason, SSL.com began issuing EV code signing certificates on YubiKey using ECCP256 or ECCP384 instead of RSA.
This limit no longer applies to YubiKey devices with firmware 5.7.4 or later. Firmware 5.7.4 adds support for RSA-3072 and RSA-4096 key generation, along with Ed25519 and X25519. Yubico submitted this firmware for FIPS 140-3 validation, and the YubiKey 5 FIPS Series is now validated under Certificate #5291.
Customers who order a new code signing certificate on a YubiKey with firmware 5.7.4 or later have 2 algorithm options:
RSA3072 (new)
ECCP256 or ECCP384
Customers must check their YubiKey firmware version before choosing RSA3072. Customers can check the firmware version using the YubiKey Manager application or the
ykman infocommand. Customers must update to firmware 5.7.4 or later if their device reports an older firmware version.Existing certificates
Certificates issued before May 31, 2021, with 2048-bit RSA keys remain valid until expiration. Existing certificate holders do not need to take any action.
eSigner
SSL issues eSigner EV code signing certificates with 3072-bit RSA keys.
As always, if you have any questions about the new key size requirements or any other issue relating to SSL’s products and services, please contact us by email at Support@SSL.com, by phone at 1-877-SSL-SECURE, or by using the chat link on this page. You can also find answers to many common support questions in the SSL knowledgebase.