Can we use higher strength SHA along with lower strength RSA key in SSL?

Question

I have noticed when the RSA public key is 2048 bit, SHA-256 bit used for signatures. When the key is 3072 bit, SHA-384 bit used. When the key is 4096 bit, SHA-512 bit used.

I have tried the following commands.

openssl genrsa -out my.key 2048
openssl req -new -sha512 -key my.key -out my.csr

It worked without any errors.

My question is that, will there be any issues when the SHA-512 is used with 2048 bit?

Answer 1

In general, no, there is no security problem with using overkill that fits in your budget.

Maybe there are constraints in your application or protocol that would prevent you from using SHA-512 with 2048-bit RSA moduli, but we can't say without more details about your application or protocol.