perf(certmanager): reduce CA key size from RSA-4096 to RSA-2048

RSA-4096 CA generation blocks service startup for minutes on slow ARM
hardware. The CA key is only used to sign server certs, never in TLS
handshakes, so 2048 bits provides sufficient security for a local CA
while being ~4-8x faster to generate.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Tobias Gesellchen
2026-05-03 21:11:41 +02:00
co-authored by Claude Sonnet 4.6
parent 06042f8728
commit ac44fdace6
+1 -1
View File
@@ -137,7 +137,7 @@ func (cm *CertificateManager) GetServerTLSConfig(domains []string) (*tls.Config,
// GenerateCA generates a new CA certificate and key.
func (cm *CertificateManager) GenerateCA() error {
priv, err := rsa.GenerateKey(rand.Reader, 4096)
priv, err := rsa.GenerateKey(rand.Reader, 2048)
if err != nil {
return err
}