Skip to content

Commit a1dc30f

Browse files
committed
docs: Fix TLS key length admonition
1 parent 9a23e70 commit a1dc30f

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

docs/modules/secret-operator/pages/secretclass.adoc

+4-1
Original file line numberDiff line numberDiff line change
@@ -51,12 +51,15 @@ include::example$secretclass-tls-key-length.yaml[]
5151
<2> `autoTls.ca.keyGeneration.rsa` specifies the RSA key pair algorithm (RSA currently is the only one supported)
5252
<3> `autoTls.ca.keyGeneration.rsa.length` specifies the amount of bits used for generating the RSA key pair. Currently, `2048`, `3072` and `4096` are supported. Defaults to `2048` bits.
5353

54-
CAUTION: Using more than `2048` bits will significantly increase the computation time to create new key pairs.
54+
CAUTION
55+
====
56+
Using more than `2048` bits will significantly increase the computation time to create new key pairs.
5557
The SSL Labs https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices[SSL and TLS Deployment Best Practices] as of 2024-10-01 recommend
5658

5759
> For most websites, using RSA keys stronger than 2,048 bits and ECDSA keys stronger than 256 bits is a waste of CPU power and might impair user experience
5860

5961
If options higher than `2048` are chosen, the CPU resources for the secret operator should be increased in order to avoid Pods being stuck in `Pending` waiting for the computation of their key pair.
62+
====
6063

6164
==== Certificate lifetime
6265

0 commit comments

Comments
 (0)