[cabfperf] Recommended Max Number of SANs in a Certificate

[Ryan Hurst]

I don't think making a recommendation for setting a maximum number of SANs is really appropriate. At least in the context of performance.

What's important when thinking about the size of the certificate is not the size of the certificate itself but how much other data is being sent in the TLS exchange.

25 SANs may very well be fine in one case and be a problem in another.

It's also highly dependent on the length of the domain names themselves.

I would add that the complexity of the certificate chain has a much larger impact then additional SANs; for example including one intermediate will add it least a K.

Ryan Hurst

Sent from my phone, please forgive the brevity.

> On May 1, 2014, at 10:18 AM, Wayne Thayer <wthayer at godaddy.com> wrote:
> 
> This working group is only planning to make recommendations. Is 25 SANs per certificate a good recommended max that is both practical and reasonable from a performance perspective?
>  
> From: Rick Andrews [mailto:Rick_Andrews at symantec.com] 
> Sent: Thursday, May 01, 2014 10:15 AM
> To: Jeremy Rowley; Wayne Thayer; performance at cabforum.org
> Subject: RE: [cabfperf] Recommended Max Number of SANs in a Certificate
>  
> I think imposing a maximum is a bad idea. Some customers want 100 or more SANs. I’m sure they’re aware of the performance implications, yet they want them anyway. I can’t think of a good security argument for denying them. So if it’s just performance, I think we must stick to recommendations for best performance, not requirements.
>  
> From: performance-bounces at cabforum.org [mailto:performance-bounces at cabforum.org] On Behalf Of Jeremy Rowley
> Sent: Thursday, May 01, 2014 9:58 AM
> To: 'Wayne Thayer'; performance at cabforum.org
> Subject: Re: [cabfperf] Recommended Max Number of SANs in a Certificate
>  
> We currently recommend a maximum of 25.  However, we have some customers that need more because of their particular server configuration.  I think it’d be more productive to discuss individual certificate components than adopt a total size limitation and let the CAs figure out how to make it work.
>  
> From: performance-bounces at cabforum.org [mailto:performance-bounces at cabforum.org] On Behalf Of Wayne Thayer
> Sent: Thursday, May 1, 2014 10:56 AM
> To: performance at cabforum.org
> Subject: [cabfperf] Recommended Max Number of SANs in a Certificate
>  
> Certificates with dozens of SAN entries have become common, in part due to the popularity of CDNs that use these certs to conserve scarce IPv4 addresses. This data can increase the size of the certificate by 25% or more. Should we recommend a maximum number of SANs in a certificate? If so, what should that number be? Or should we look at the total size of the certificate rather than individual fields?
>  
> Thanks,
>  
> Wayne
> _______________________________________________
> Performance mailing list
> Performance at cabforum.org
> https://cabforum.org/mailman/listinfo/performance
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://cabforum.org/pipermail/performance/attachments/20140501/087c493a/attachment.html