[cabfperf] Recommended Max Number of SANs in a Certificate

[Geoff Keating]

Perhaps the recommendation should be to use SNI and have only one SAN in the certificate?


> On May 1, 2014, at 10:51 AM, Wayne Thayer <wthayer at godaddy.com> wrote:
> 
> This seems like an argument for doing nothing. Yes, the number of SANs is only one component of the size of the cert. The size of the cert is only one component of the size of data in the handshake, and the size of data in the handshake needs to be considered relative to the TCP initcwnd. Taking all of these variables into account is beyond the expertise of most certificate subscribers and server operators.
>  
> Can we recommend a maximum number of SANs if we do so in the context of other recommendations for certificate size such as the number of SCTs, removing duplicate fields and extraneous data, choosing appropriate key size, etc? Should we also attempt to define a max certificate size? If so, any thoughts on what that should be?
>  
> From: Rick Andrews [mailto:Rick_Andrews at symantec.com] 
> Sent: Thursday, May 01, 2014 10:32 AM
> To: Ryan Hurst; Wayne Thayer
> Cc: Jeremy Rowley; performance at cabforum.org
> Subject: RE: [cabfperf] Recommended Max Number of SANs in a Certificate
>  
> +1 I was just composing a similar reply. For example, an EV cert that will need 3 SCTs may overflow the initial congestion window with 25 SANs. Better to focus on the final size of the cert.
>  
> From: Ryan Hurst [mailto:ryan.hurst at globalsign.com] 
> Sent: Thursday, May 01, 2014 10:30 AM
> To: Wayne Thayer
> Cc: Rick Andrews; Jeremy Rowley; performance at cabforum.org
> Subject: Re: [cabfperf] Recommended Max Number of SANs in a Certificate
>  
> I don't think making a recommendation for setting a maximum number of SANs is really appropriate. At least in the context of performance.
>  
> What's important when thinking about the size of the certificate is not the size of the certificate itself but how much other data is being sent in the TLS exchange.
>  
> 25 SANs may very well be fine in one case and be a problem in another.
>  
> It's also highly dependent on the length of the domain names themselves.
>  
> I would add that the complexity of the certificate chain has a much larger impact then additional SANs; for example including one intermediate will add it least a K.
>  
> Ryan Hurst
>  
> Sent from my phone, please forgive the brevity.
> 
> On May 1, 2014, at 10:18 AM, Wayne Thayer <wthayer at godaddy.com> wrote:
> 
> This working group is only planning to make recommendations. Is 25 SANs per certificate a good recommended max that is both practical and reasonable from a performance perspective?
>  
> From: Rick Andrews [mailto:Rick_Andrews at symantec.com] 
> Sent: Thursday, May 01, 2014 10:15 AM
> To: Jeremy Rowley; Wayne Thayer; performance at cabforum.org
> Subject: RE: [cabfperf] Recommended Max Number of SANs in a Certificate
>  
> I think imposing a maximum is a bad idea. Some customers want 100 or more SANs. I’m sure they’re aware of the performance implications, yet they want them anyway. I can’t think of a good security argument for denying them. So if it’s just performance, I think we must stick to recommendations for best performance, not requirements.
>  
> From: performance-bounces at cabforum.org [mailto:performance-bounces at cabforum.org] On Behalf Of Jeremy Rowley
> Sent: Thursday, May 01, 2014 9:58 AM
> To: 'Wayne Thayer'; performance at cabforum.org
> Subject: Re: [cabfperf] Recommended Max Number of SANs in a Certificate
>  
> We currently recommend a maximum of 25.  However, we have some customers that need more because of their particular server configuration.  I think it’d be more productive to discuss individual certificate components than adopt a total size limitation and let the CAs figure out how to make it work.
>  
> From: performance-bounces at cabforum.org [mailto:performance-bounces at cabforum.org] On Behalf Of Wayne Thayer
> Sent: Thursday, May 1, 2014 10:56 AM
> To: performance at cabforum.org
> Subject: [cabfperf] Recommended Max Number of SANs in a Certificate
>  
> Certificates with dozens of SAN entries have become common, in part due to the popularity of CDNs that use these certs to conserve scarce IPv4 addresses. This data can increase the size of the certificate by 25% or more. Should we recommend a maximum number of SANs in a certificate? If so, what should that number be? Or should we look at the total size of the certificate rather than individual fields?
>  
> Thanks,
>  
> Wayne
> _______________________________________________
> Performance mailing list
> Performance at cabforum.org
> https://cabforum.org/mailman/listinfo/performance
> _______________________________________________
> Performance mailing list
> Performance at cabforum.org
> https://cabforum.org/mailman/listinfo/performance
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://cabforum.org/pipermail/performance/attachments/20140501/38c43f2d/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2511 bytes
Desc: not available
Url : https://cabforum.org/pipermail/performance/attachments/20140501/38c43f2d/attachment.bin