Certificate Chain Size Calculator
Add up a TLS certificate chain in bytes, count the records it spans and see the handshake bandwidth it costs at scale.
Inputs
Sending the root is wasted bytes — clients already trust it.
Total Chain Size
4,309bytes
Total Chain Size
4.21KiB
TLS Records (16 KiB each)
1
Extra Round Trips at 10 Initcwnd
0
Daily Certificate Bandwidth
40.13GiB
Assessment
Lean chain — fits inside one initial congestion window
Step by step
Values used
Leaf certificate size = 1,400 bytes; Average intermediate size = 1,200 bytes; Intermediate CAs in the chain = 2 certs; Send the root certificate too = No; Stapled OCSP response = 500 bytes; TLS full handshakes per day = 10,000,000 handshakes
Certificate Chain Size
chain bytes = leaf + (intermediates × average size) + optional root + OCSP staple + 3 bytes of length prefix per certificate.
Cold-start round trips
extra round trips = ⌈chain ÷ (10 × 1460 bytes)⌉ − 1, using the default initial congestion window.
Total Chain Size
= 4,309 bytes
Total Chain Size
= 4.21 KiB
TLS Records (16 KiB each)
= 1
Extra Round Trips at 10 Initcwnd
= 0
Daily Certificate Bandwidth
= 40.13 GiB
Assessment
= Lean chain — fits inside one initial congestion window
How it works
The TLS Certificate message carries every certificate except the trusted root, each with a 3-byte length prefix. Once the chain exceeds the initial congestion window of about 14.6 kB, the server must wait for an ACK mid-handshake, adding a full round trip to every new connection. Certificate bytes are paid on every full handshake, so a chain with a needless root and an RSA-4096 leaf can add tens of milliseconds to first-byte latency and terabytes of monthly egress at CDN scale.
Formulas
Certificate Chain Size
chain bytes = leaf + (intermediates × average size) + optional root + OCSP staple + 3 bytes of length prefix per certificate.
- leaf
- Your end-entity certificate
- intermediate
- Each CA certificate needed to reach a trusted root
- 3 bytes
- The TLS Certificate message length prefix on each entry
Cold-start round trips
extra round trips = ⌈chain ÷ (10 × 1460 bytes)⌉ − 1, using the default initial congestion window.
Frequently Asked Questions
How is Certificate Chain Size calculated?
chain bytes = leaf + (intermediates × average size) + optional root + OCSP staple + 3 bytes of length prefix per certificate. The TLS Certificate message carries every certificate except the trusted root, each with a 3-byte length prefix. Once the chain exceeds the initial congestion window of about 14.6 kB, the server must wait for an ACK mid-handshake, adding a full round trip to every new connection.
Why does Certificate Chain Size matter?
Certificate bytes are paid on every full handshake, so a chain with a needless root and an RSA-4096 leaf can add tens of milliseconds to first-byte latency and terabytes of monthly egress at CDN scale.
What values do I need to enter?
This calculator takes 6 inputs: Leaf certificate size, Average intermediate size, Intermediate CAs in the chain, Send the root certificate too, Stapled OCSP response, TLS full handshakes per day. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should I send the root certificate?
No. Clients only trust a root they already have in their store, so transmitting it wastes 1–2 kB per handshake and gains nothing. Send the leaf plus the intermediates that bridge to a widely trusted root.