Enum CertificateKeyAlgorithm

Key algorithm used for the leaf ("fake") certificates the proxy generates per intercepted host.

Namespace: Titanium.Web.Proxy.Network

Assembly: Titanium.Web.Proxy.dll

Syntax

public enum CertificateKeyAlgorithm

Fields

Name	Description
EcdsaP256	ECDSA over NIST P-256. Roughly fifty times cheaper to generate than Rsa2048 while still giving every host its own key, which effectively removes certificate generation from first-visit latency. Requires clients that accept ECDSA server certificates - universal among current browsers and TLS libraries, but not in very old ones. The root certificate is unaffected and stays RSA, so it continues to sign these leaves.
Rsa2048	RSA 2048. The default, and what every TLS client in existence accepts - including legacy stacks with no elliptic-curve support, which is often exactly what a debugging proxy is pointed at. Key generation is expensive, but LeafRsaKeyPairBufferSize (default 8) pre-generates RSA-2048 pairs so many first visits avoid paying that cost on the CONNECT path. Certificate caching can also avoid regeneration entirely.

Name

Description

EcdsaP256

ECDSA over NIST P-256. Roughly fifty times cheaper to generate than Rsa2048 while still giving every host its own key, which effectively removes certificate generation from first-visit latency. Requires clients that accept ECDSA server certificates - universal among current browsers and TLS libraries, but not in very old ones. The root certificate is unaffected and stays RSA, so it continues to sign these leaves.

Rsa2048

RSA 2048. The default, and what every TLS client in existence accepts - including legacy stacks with no elliptic-curve support, which is often exactly what a debugging proxy is pointed at. Key generation is expensive, but LeafRsaKeyPairBufferSize (default 8) pre-generates RSA-2048 pairs so many first visits avoid paying that cost on the CONNECT path. Certificate caching can also avoid regeneration entirely.