--- title: The Great Certificate Size Explosion – IPsec Series, Part 7 description: A hands-on walkthrough generates classical (Ed25519, ECDSA, RSA) and post-quantum (ML-DSA, SLH-DSA) certificates using OpenSSL 3.5's native NIST PQC support... canonical: https://daily.dev/posts/the-great-certificate-size-explosion-ipsec-series-part-7-qqoeuqaeo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Great Certificate Size Explosion – IPsec Series, Part 7 | daily.dev og:description: A hands-on walkthrough generates classical (Ed25519, ECDSA, RSA) and post-quantum (ML-DSA, SLH-DSA) certificates using OpenSSL 3.5's native NIST PQC support... og:url: https://daily.dev/posts/the-great-certificate-size-explosion-ipsec-series-part-7-qqoeuqaeo og:image: https://api.daily.dev/og/posts/QqoeUqaEo.png og:image:alt: The Great Certificate Size Explosion – IPsec Series, Part 7 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Great Certificate Size Explosion – IPsec Series, Part 7 **[Cisco](https://daily.dev/sources/cisco)** · 8 min read · 1 upvotes · 0 comments ## Summary A hands-on walkthrough generates classical (Ed25519, ECDSA, RSA) and post-quantum (ML-DSA, SLH-DSA) certificates using OpenSSL 3.5's native NIST PQC support inside a throwaway Alpine container. Measuring certificate sizes reveals dramatic growth: an Ed25519 cert is 326 bytes while ML-DSA-65 is 5516 bytes (~17x larger), and SLH-DSA-128f signatures alone hit 17KB. The piece explains the ~230-260 byte fixed X.509 overhead, signing speed differences (ML-DSA is fast, SLH-DSA-128s takes 100+ms), and why swapping certificate chains to ML-DSA can balloon IKEv2 handshakes to 15-20KB, forcing heavy fragmentation with real costs around packet loss, middlebox handling, and pre-auth attack surface. It closes by signing, verifying, and tampering with messages to demonstrate integrity guarantees, setting up Part 8's live IKEv2 VPN authentication test. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How much bigger is a post-quantum ML-DSA-65 certificate compared to an Ed25519 certificate? An ML-DSA-65 self-signed DER certificate is about 5516 bytes versus 326 bytes for Ed25519, roughly 17 times larger. The gap comes from ML-DSA's larger public key (1952 bytes) and signature (3309 bytes), compared to Ed25519's tiny 32-byte key and 64-byte signature, plus a roughly fixed ~230-260 byte X.509 structural overhead in both cases. _Anyone sizing up PQC migration overhead can track certificate and handshake benchmarks like this on daily.dev._ ### Does OpenSSL 3.5 support post-quantum signature algorithms like ML-DSA and SLH-DSA natively? Yes, OpenSSL 3.5 is the first mainstream release with native support for all three NIST post-quantum algorithms: ML-KEM, ML-DSA, and SLH-DSA, built into the default provider with no external plugins or patches required. Generating a post-quantum key uses the exact same openssl genpkey command as a classical key, just with a different algorithm name. _Developers planning PQC certificate rollouts can follow tooling changes like this via daily.dev._ ### Why does ML-DSA slow down IKEv2 VPN handshakes more than ECDSA? ML-DSA and SLH-DSA certificate chains run 15-20 KB versus about 1.2 KB for a 3-cert ECDSA chain, forcing the IKE_AUTH exchange into heavy IP fragmentation. Because reassembly requires every fragment to arrive, lossy links see more retransmits and latency spikes, middleboxes like firewalls and NATs often mishandle fragmented UDP, and responders must buffer unauthenticated fragments, expanding pre-auth attack surface. _Engineers evaluating PQC's real-world VPN impact can track handshake and fragmentation issues on daily.dev._ ## Similar posts on daily.dev - [Mutual Post-Quantum Auth over IKEv2 – IPsec Series, Part 8](https://daily.dev/posts/mutual-post-quantum-auth-over-ikev2-ipsec-series-part-8-xm1etcoxb) · Cisco · 1 upvotes · 0 comments - [Watch a Hybrid Post-Quantum Handshake on the Wire – IPsec Series, Part 4](https://daily.dev/posts/watch-a-hybrid-post-quantum-handshake-on-the-wire-ipsec-series-part-4-rpovq4vpj) · Cisco · 0 upvotes · 0 comments - [1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it](https://daily.dev/posts/1-1-1-1-now-supports-post-quantum-dnssec-all-2-420-bytes-of-it-c7xuhmdzz) · Cloudflare · 3 upvotes · 0 comments - [Who Goes There? Post-Quantum Authentication – IPsec Series, Part 6](https://daily.dev/posts/who-goes-there-post-quantum-authentication-ipsec-series-part-6-iskqiozsb) · Cisco · 0 upvotes · 0 comments - [The State of Post-Quantum Cryptography](https://daily.dev/posts/the-state-of-post-quantum-cryptography-hjfyungt7) · Feisty Duck · 0 upvotes · 0 comments --- Tags: [#quantum-computing](https://daily.dev/tags/quantum-computing), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/the-great-certificate-size-explosion-ipsec-series-part-7-qqoeuqaeo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Great Certificate Size Explosion – IPsec Series, Part 7","url":"https://daily.dev/posts/the-great-certificate-size-explosion-ipsec-series-part-7-qqoeuqaeo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-great-certificate-size-explosion-ipsec-series-part-7-qqoeuqaeo"},"datePublished":"2026-08-17T14:02:59.640Z","dateModified":"2026-09-14T09:01:51.724Z","description":"A hands-on walkthrough generates classical (Ed25519, ECDSA, RSA) and post-quantum (ML-DSA, SLH-DSA) certificates using OpenSSL 3.5's native NIST PQC support...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9f4c7f7b70c71aab366bed7749f120ea?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9f4c7f7b70c71aab366bed7749f120ea?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cisco","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cisco","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/68b8a8be17184235a5067d7c84162f77","url":"https://daily.dev/sources/cisco"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-great-certificate-size-explosion-ipsec-series-part-7-qqoeuqaeo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"quantum-computing,cryptography","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cisco","item":"https://daily.dev/sources/cisco"},{"@type":"ListItem","position":3,"name":"The Great Certificate Size Explosion – IPsec Series, Part 7"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-great-certificate-size-explosion-ipsec-series-part-7-qqoeuqaeo#faq","mainEntity":[{"@type":"Question","name":"How much bigger is a post-quantum ML-DSA-65 certificate compared to an Ed25519 certificate?","acceptedAnswer":{"@type":"Answer","text":"An ML-DSA-65 self-signed DER certificate is about 5516 bytes versus 326 bytes for Ed25519, roughly 17 times larger. The gap comes from ML-DSA's larger public key (1952 bytes) and signature (3309 bytes), compared to Ed25519's tiny 32-byte key and 64-byte signature, plus a roughly fixed ~230-260 byte X.509 structural overhead in both cases. Anyone sizing up PQC migration overhead can track certificate and handshake benchmarks like this on daily.dev."}},{"@type":"Question","name":"Does OpenSSL 3.5 support post-quantum signature algorithms like ML-DSA and SLH-DSA natively?","acceptedAnswer":{"@type":"Answer","text":"Yes, OpenSSL 3.5 is the first mainstream release with native support for all three NIST post-quantum algorithms: ML-KEM, ML-DSA, and SLH-DSA, built into the default provider with no external plugins or patches required. Generating a post-quantum key uses the exact same openssl genpkey command as a classical key, just with a different algorithm name. Developers planning PQC certificate rollouts can follow tooling changes like this via daily.dev."}},{"@type":"Question","name":"Why does ML-DSA slow down IKEv2 VPN handshakes more than ECDSA?","acceptedAnswer":{"@type":"Answer","text":"ML-DSA and SLH-DSA certificate chains run 15-20 KB versus about 1.2 KB for a 3-cert ECDSA chain, forcing the IKE_AUTH exchange into heavy IP fragmentation. Because reassembly requires every fragment to arrive, lossy links see more retransmits and latency spikes, middleboxes like firewalls and NATs often mishandle fragmented UDP, and responders must buffer unauthenticated fragments, expanding pre-auth attack surface. Engineers evaluating PQC's real-world VPN impact can track handshake and fragmentation issues on daily.dev."}}]} ```