4096 bit RSA encryption keys vs 2048

Advisories recommend 2048 for now. Security experts are projecting that 2048 bits will be sufficient for commercial use until around the year 2030.

The main downside to using a large cert, such as 3072 or 4096, is that the algorithm is slightly slower (still fractions of a second, though).

Current browsers should all support certs upto 4096.

Some CAs won't issue a cert that large, so if you want a 4096 bit cert, you might have to shop around for a CA that will issue it.

I always generate 4096 bit keys since the downside is minimal (slightly lower performance) and security is slightly higher (although not as high as one would like). Larger keys like 8192 bit or even larger take forever to generate and require specially patched sw to use so are impractical. Luckily there are other algorithms slowly replacing rsa...