certificates
ECC vs RSA SSL Certificates in 2026: Performance, Security, and Which to Choose
RSA (Rivest–Shamir–Adleman) has been the dominant algorithm for SSL certificates since the early web. ECC (Elliptic Curve Cryptography) is newer, more mathematically efficient, and produces much smaller keys for equivalent security. Understanding the practical difference matters for performance-sensitive sites, IoT devices, and environments where TLS handshake speed is measurable.
Certificate Decoder
Decode your certificate to see whether it uses RSA or ECC and your key size.
Try It Free →256
ECC key size (bits)
P-256 (secp256r1) — recommended ECC curve in 2026. Equivalent to 3072-bit RSA security. Supported by all modern browsers and servers.
The key size equivalence comes from the mathematical hardness of the underlying problem. RSA security depends on integer factorization (hard, but key sizes must scale aggressively). ECC security depends on the discrete logarithm problem on an elliptic curve (harder per bit — security scales much better with key size):
| ECC Key Size | Equivalent RSA Key Size | Security Level |
|---|---|---|
| 224-bit (P-224) | 2048-bit RSA | 112-bit security |
| 256-bit (P-256) | 3072-bit RSA | 128-bit security ← use this |
| 384-bit (P-384) | 7680-bit RSA | 192-bit security |
| 521-bit (P-521) | 15360-bit RSA | 256-bit security (overkill) |
Performance Comparison: TLS Handshake Speed
| Factor | RSA 2048 | ECC P-256 | Winner |
|---|---|---|---|
| Key generation time | ~0.5–2s | ~0.01–0.05s | ECC (10–100× faster) |
| TLS handshake CPU cost | Higher (server signs large key) | Lower (smaller signature) | ECC |
| Signature size | 256 bytes (2048-bit key) | 64 bytes (P-256) | ECC (4× smaller) |
| Certificate file size | ~1.4 KB | ~0.7 KB | ECC (~50% smaller) |
| Client compatibility | Universal — all clients | All modern (99%+ of browsers) | RSA (for legacy clients) |
| Forward secrecy | With ECDHE/DHE key exchange | With ECDHE key exchange | Same (both require ECDHE) |
| Hardware acceleration | AES-NI available on most CPUs | Less hardware support | RSA (on some hardware) |
| CA support (2026) | Universal | Most CAs (Let's Encrypt, DigiCert, Sectigo) | RSA (wider CA support) |
Generating an ECC Certificate
# Generate ECC P-256 private key:
openssl ecparam -name prime256v1 -genkey -noout -out yourdomain-ecc.key
# Or with newer OpenSSL (1.1+) syntax:
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 \
-out yourdomain-ecc.key
# Generate CSR from the ECC key:
openssl req -new \
-key yourdomain-ecc.key \
-out yourdomain-ecc.csr \
-subj "/C=US/ST=California/L=San Francisco/O=Acme Corp Ltd/CN=yourdomain.com"
# Verify the CSR uses ECC:
openssl req -in yourdomain-ecc.csr -noout -text | grep "Public Key Algorithm"
# Public Key Algorithm: id-ecPublicKey ← ECC confirmed
# Or verify the key type:
openssl ec -in yourdomain-ecc.key -noout -text 2>&1 | head -3
# read EC key
# Private-Key: (256 bit)
# ASN1 OID: prime256v1
Generating an RSA Certificate
# Generate RSA 2048-bit key + CSR (standard for broad compatibility):
openssl req -new -newkey rsa:2048 -nodes \
-keyout yourdomain-rsa.key \
-out yourdomain-rsa.csr \
-subj "/C=US/ST=California/L=San Francisco/O=Acme Corp Ltd/CN=yourdomain.com"
# Verify the CSR uses RSA:
openssl req -in yourdomain-rsa.csr -noout -text | grep "Public Key Algorithm"
# Public Key Algorithm: rsaEncryption
# Verify key size:
openssl rsa -in yourdomain-rsa.key -noout -text 2>&1 | grep "Private-Key"
# Private-Key: (2048 bit, 2 primes)
Configuring Apache and Nginx for ECC
# Apache — prioritize ECDHE cipher suites for ECC performance:
SSLCertificateFile /etc/ssl/certs/yourdomain-ecc.crt
SSLCertificateKeyFile /etc/ssl/private/yourdomain-ecc.key
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
# Nginx — ECC configuration:
ssl_certificate /etc/ssl/certs/yourdomain-ecc.crt;
ssl_certificate_key /etc/ssl/private/yourdomain-ecc.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256;
ssl_prefer_server_ciphers off;
Checking What Algorithm Your Site Uses
$ openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -text | grep -A3 "Public Key Algorithm"
# ECC (P-256) certificate:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
ASN1 OID: prime256v1
NIST CURVE: P-256
# RSA certificate:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
# Check cipher negotiated during handshake:
$ openssl s_client -connect yourdomain.com:443 2>/dev/null | grep "Cipher is"
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Dual Certificate Setup (RSA + ECC)
Nginx supports serving both an ECC and RSA certificate simultaneously. The browser negotiates which one to use — modern clients get ECC, legacy clients fall back to RSA:
# Nginx dual certificate configuration:
server {
listen 443 ssl;
server_name yourdomain.com;
# ECC certificate (used for modern clients):
ssl_certificate /etc/ssl/certs/yourdomain-ecc.crt;
ssl_certificate_key /etc/ssl/private/yourdomain-ecc.key;
# RSA certificate (fallback for legacy clients):
ssl_certificate /etc/ssl/certs/yourdomain-rsa.crt;
ssl_certificate_key /etc/ssl/private/yourdomain-rsa.key;
# Both will work; Nginx picks based on client cipher support
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
}
Which to Choose in 2026?
- For most websites (blogs, SaaS, e-commerce): RSA 2048-bit is safe and universally compatible. Let's Encrypt defaults to RSA 2048.
- For performance-critical sites with high TLS connection volume: ECC P-256 reduces server CPU load during handshakes — measurable at scale (100K+ TLS handshakes/day).
- For IoT or embedded devices: ECC is preferred — smaller key sizes mean less memory and faster operations on constrained hardware.
- For maximum compatibility with legacy clients: RSA 2048 — old Android 4.x, Windows XP IE, and some old Java clients don't support ECC.
- For new builds where compatibility is confirmed: ECC P-256 is the right choice — it provides better security-per-bit and better handshake performance.
Generating ECC Certificates on macOS
macOS
Terminal / Homebrew
macOS includes LibreSSL which supports ECC operations. For the most complete ECC support (including newer curves), install full OpenSSL via Homebrew:
# Install OpenSSL (optional — LibreSSL in macOS Terminal supports P-256 and P-384)
brew install openssl
OPENSSL=/opt/homebrew/opt/openssl/bin/openssl
# Generate an ECC private key (P-256 — recommended):
$OPENSSL ecparam -genkey -name prime256v1 -out ecc.key
# Or P-384 for higher security:
$OPENSSL ecparam -genkey -name secp384r1 -out ecc-p384.key
# Generate CSR from ECC key:
$OPENSSL req -new -key ecc.key -out ecc.csr \
-subj "/C=US/ST=State/L=City/O=Your Company/CN=yourdomain.com"
# Verify the key type and curve:
$OPENSSL ec -in ecc.key -noout -text | grep "ASN1 OID"
# Expected: ASN1 OID: prime256v1
ECC vs RSA on Homebrew Servers
# Deploy ECC cert on Homebrew Apache
# /opt/homebrew/etc/httpd/extra/httpd-ssl.conf — same directives as Linux:
SSLCertificateFile /opt/homebrew/etc/httpd/ssl/yourdomain.crt
SSLCertificateKeyFile /opt/homebrew/etc/httpd/ssl/ecc.key
# Test TLS handshake — ECC should negotiate ECDHE cipher suites:
openssl s_client -connect localhost:443 2>/dev/null | grep "Cipher"
# Expected: ECDHE-ECDSA-AES256-GCM-SHA384 (ECDHE = ephemeral ECC key exchange)
Check your certificate algorithm and key type
Our SSL checker shows whether you're using RSA or ECC, the key size, and all certificate details.