diff --git a/apache2.changes b/apache2.changes
index 2dcdfbb..ab7c99d 100644
--- a/apache2.changes
+++ b/apache2.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Fri Aug  2 08:18:03 UTC 2013 - meissner@suse.com
+
+- Make the default keysize in the sample gensslcerts 2048 bits to match
+  government recommendations.
+
 -------------------------------------------------------------------
 Thu Aug  1 02:06:38 UTC 2013 - crrodriguez@opensuse.org
 
diff --git a/gensslcert b/gensslcert
index 3480323..bce2e3d 100644
--- a/gensslcert
+++ b/gensslcert
@@ -95,7 +95,7 @@ echo;myecho creating CA key ...
 
 cat >$r/root/.mkcert.cfg <<EOT
 [ req ]
-default_bits           = 1024
+default_bits           = 2048
 default_keyfile        = keyfile.pem
 distinguished_name     = req_distinguished_name
 attributes             = req_attributes
@@ -124,11 +124,11 @@ cp -pv $sslcrtdir/${name}ca.crt $r/srv/www/htdocs/$(echo $name | tr 'a-z' 'A-Z')
 # Server CERT
 #
 echo;myecho creating server key ...
-(umask 0377 ; $openssl genrsa -rand $r/etc/rc.config:$r/var/log/messages -out $sslkeydir/${name}server.key 1024 || myexit $LINENO $?)
+(umask 0377 ; $openssl genrsa -rand $r/etc/rc.config:$r/var/log/messages -out $sslkeydir/${name}server.key 2048 || myexit $LINENO $?)
 
 cat >$r/root/.mkcert.cfg <<EOT
 [ req ]
-default_bits           = 1024
+default_bits           = 2048
 default_keyfile        = keyfile.pem
 distinguished_name     = req_distinguished_name
 attributes             = req_attributes