From ac44fdace6d8485e606fef983b31c3de72ef519a Mon Sep 17 00:00:00 2001 From: Tobias Gesellchen Date: Sun, 3 May 2026 20:48:12 +0200 Subject: [PATCH] perf(certmanager): reduce CA key size from RSA-4096 to RSA-2048 RSA-4096 CA generation blocks service startup for minutes on slow ARM hardware. The CA key is only used to sign server certs, never in TLS handshakes, so 2048 bits provides sufficient security for a local CA while being ~4-8x faster to generate. Co-Authored-By: Claude Sonnet 4.6 --- pkg/service/certmanager/certmanager.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/service/certmanager/certmanager.go b/pkg/service/certmanager/certmanager.go index 5c1314d..6ede602 100644 --- a/pkg/service/certmanager/certmanager.go +++ b/pkg/service/certmanager/certmanager.go @@ -137,7 +137,7 @@ func (cm *CertificateManager) GetServerTLSConfig(domains []string) (*tls.Config, // GenerateCA generates a new CA certificate and key. func (cm *CertificateManager) GenerateCA() error { - priv, err := rsa.GenerateKey(rand.Reader, 4096) + priv, err := rsa.GenerateKey(rand.Reader, 2048) if err != nil { return err }