Increase default key size for CA + Server certs to 3072

[Harry Pidcock]

Currently Juju generates 2048 bit RSA keys for CA and mongod.
These certificates have a 10 year validity period.

Post 2030 the recommended minimum key-size for RSA is 3072bits.
We should increase the key size to 3072 in anticipation for 2030 recommendations, as some key-pairs could still be in use around 2030.

See https://www.keylength.com/en/4/ for more information on recommendations.

[John A Meinel (jameinel)]

Is it worth doing that vs expecting we would switch to something that isn't RSA? It would also be good to understand the cost of a controller running against 5000 agents using a larger RSA key. (Is there a significant difference in recovery time, or is it lost in the noise?)

[Harry Pidcock (hpidcock)]

https://github.com/juju/juju/pull/10606

[Harry Pidcock (hpidcock)]

Yes, we should move to an elliptic curve instead of RSA, but for now this is the quickest solution with the best compatibility.