- improve security by making certificates valid for only 90 days instead of 10 years - add SubjectAltName - remove unnecessary parameters - use carbon immutable to make sure expiration date stays the same
ECC
secp521r1
- Replace RSA 4096 with ECDSA secp521r1 for stronger security (256-bit vs 112-bit) - Faster certificate generation (3-4x speed improvement) - 75% smaller key sizes (0.8KB vs 3.2KB) improves storage and transmission
