Using Transport Layer Security to protect data
TLS uses X.509 certificates to cryptographically verify the identity of one or both communicating parties. A secure TLS connection can be established when the connecting party trusts the certificate presented by the service and can verify that it was issued by a trusted Certificate Authority (CA).
Choosing a CA
In many cases, a TLS service will need to be used and trusted by unknown clients, for example, members of the public. In this case, the service must use a certificate from a public CA in the Web PKI. The NCSC provides guidance on provisioning and managing certificates in the web PKI.
Many public CAs are available, with differing levels of trust across client trust stores, technical support offerings, and certificate issuance and management options. When selecting a CA, you should ensure that it is trusted by the clients that need to access your service and that it meets your requirements.
If you are hosting your service in the cloud, many cloud providers offer CA services and host their own CAs. Using these cloud-native CA services can simplify integration and automate certificate management, provided the CA offers sufficient security properties for your purposes. The NCSC’s cloud security guidance will help you make this assessment.
If your organization manages its own internal CA, and the service is only accessed by managed clients that trust it, it may be appropriate to use certificates issued by the internal CA. See the NCSC’s guidance on designing and building a privately hosted public key infrastructure (PKI).
Recommended certificate parameters
When requesting or renewing a certificate, you will need to choose parameters for your private key and certificate signing request (CSR). Whether you’re using a public or a private CA, the NCSC recommends using the following parameters for generation of ECC and RSA keys:
- ECDSA-256 with SHA256 on the P-256 curve
- 2048-bit RSA with SHA256
Planning for PQC
International standards for post-quantum authentication mechanisms and certificates in TLS are still being developed. Until those standards are available, you should continue using ECDSA and RSA. This recommendation will be updated to prefer post-quantum authentication mechanisms once they have been standardized.
When issuing certificates for ECDSA and RSA, you should consider your organization’s PQC migration timelines. Avoid issuing certificates with validity periods that extend beyond the point at which you expect to complete your migration from traditional cryptography. You should also identify any existing certificates that may need to be replaced as part of that transition.
Source: UK NCSC (Cyber) (2026-10-15)
