diff --git a/crypto.go b/crypto.go
index 13a5cd55..fabf9cbf 100644
--- a/crypto.go
+++ b/crypto.go
@@ -314,7 +314,7 @@ func generateCertificateAuthority(
 	cn string,
 	daysValid int,
 ) (certificate, error) {
-	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	priv, err := rsa.GenerateKey(rand.Reader, 4096)
 	if err != nil {
 		return certificate{}, fmt.Errorf("error generating rsa key: %s", err)
 	}