Certificate Chain Size Calculator
Add up a TLS certificate chain in bytes, count the records it spans and see the handshake bandwidth it costs at scale.
About Certificate Chain Size Calculator
The TLS Certificate message carries every certificate except the trusted root, each with a 3-byte length prefix. Once the chain exceeds the initial congestion window of about 14.6 kB, the server must wait for an ACK mid-handshake, adding a full round trip to every new connection. Certificate bytes are paid on every full handshake, so a chain with a needless root and an RSA-4096 leaf can add tens of milliseconds to first-byte latency and terabytes of monthly egress at CDN scale.
Formulas
Certificate Chain Size
chain bytes = leaf + (intermediates × average size) + optional root + OCSP staple + 3 bytes of length prefix per certificate.
- leaf
- Your end-entity certificate
- intermediate
- Each CA certificate needed to reach a trusted root
- 3 bytes
- The TLS Certificate message length prefix on each entry
Cold-start round trips
extra round trips = ⌈chain ÷ (10 × 1460 bytes)⌉ − 1, using the default initial congestion window.
Worked example
With the default values below, Certificate Chain Size Calculator returns Total Chain Size of 4,309. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Leaf certificate sizeaccepts 200–20,000 bytes
- 1,400 bytes
- Average intermediate sizeaccepts 200–20,000 bytes
- 1,200 bytes
- Intermediate CAs in the chainaccepts 0–8 certs
- 2 certs
- Send the root certificate too
- No
- Stapled OCSP responseaccepts 0–8,000 bytes
- 500 bytes
- TLS full handshakes per dayminimum 1 handshakes
- 10,000,000 handshakes
Results
- Total Chain Size
- 4,309 bytes
- Total Chain Size
- 4.21 KiB
- TLS Records (16 KiB each)
- 1
- Extra Round Trips at 10 Initcwnd
- 0
- Daily Certificate Bandwidth
- 40.13 GiB
- Assessment
- Lean chain — fits inside one initial congestion window
Step by step
- 1Values used
- 2Certificate Chain Size
- 3Cold-start round trips
- 4Total Chain Size= 4,309 bytes
- 5Total Chain Size= 4.21 KiB
- 6TLS Records (16 KiB each)= 1
- 7Extra Round Trips at 10 Initcwnd= 0
- 8Daily Certificate Bandwidth= 40.13 GiB
- 9Assessment= Lean chain — fits inside one initial congestion window
Assumptions and limits
- The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Certificate Chain Size calculated?
chain bytes = leaf + (intermediates × average size) + optional root + OCSP staple + 3 bytes of length prefix per certificate. The TLS Certificate message carries every certificate except the trusted root, each with a 3-byte length prefix. Once the chain exceeds the initial congestion window of about 14.6 kB, the server must wait for an ACK mid-handshake, adding a full round trip to every new connection.
Why does Certificate Chain Size matter?
Certificate bytes are paid on every full handshake, so a chain with a needless root and an RSA-4096 leaf can add tens of milliseconds to first-byte latency and terabytes of monthly egress at CDN scale.
What values do I need to enter?
This calculator takes 6 inputs: Leaf certificate size, Average intermediate size, Intermediate CAs in the chain, Send the root certificate too, Stapled OCSP response, TLS full handshakes per day. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Should I send the root certificate?
No. Clients only trust a root they already have in their store, so transmitting it wastes 1–2 kB per handshake and gains nothing. Send the leaf plus the intermediates that bridge to a widely trusted root.