Algorithm choice generates endless debate and very few practical differences — until you pick something a client cannot verify or a regulator will not accept. Here is the short version for certificates issued today.
The defaults that are fine
For TLS server certificates: ECDSA P-256. Smaller signatures, faster handshakes, universal client support. For roots and long-lived intermediates: P-384 or RSA-3072, matching the lifetime to the strength. RSA-2048 still verifies everywhere but should not be minted for anything living past 2030.
Where Ed25519 fits
Ed25519 is the best-engineered signature scheme of the classical era — deterministic, fast, misuse-resistant. Use it for SSH, code signing and internal PKI freely. For public TLS it remains a compatibility gamble: the WebPKI still runs on P-256.
What to avoid
RSA-1024 anywhere, SHA-1 signatures anywhere, and bespoke curve choices that made sense on a whiteboard. Also avoid oversizing: RSA-8192 buys milliseconds of attacker delay at a real handshake cost.
Plan for agility, not perfection
The post-quantum migration will force an algorithm change across your whole estate within the decade. The winning move today is not the perfect curve — it is making sure algorithms live in configuration, so the next change is a rollout, not a rewrite.