usually ca certificates are largish, like 4096