diff --git a/config/Config.cfc b/config/Config.cfc
index 71f6ceb..6b09441 100644
--- a/config/Config.cfc
+++ b/config/Config.cfc
@@ -4,6 +4,7 @@ component {
 		var settings = arguments.config.settings ?: {};
 
 		settings.saml2 = {};
+		settings.saml2.keySize = Val( settings.env.SAML2_KEY_SIZE ?: 2048 );
 
 		_configureExtensionSettings( settings );
 		_configureFeatures( settings );
diff --git a/services/saml/signing/SamlCertificateService.cfc b/services/saml/signing/SamlCertificateService.cfc
index e525783..e5ef781 100644
--- a/services/saml/signing/SamlCertificateService.cfc
+++ b/services/saml/signing/SamlCertificateService.cfc
@@ -5,6 +5,7 @@
 component {
 
 	property name="samlProviderMetadataGenerator" inject="delayedInjector:samlProviderMetadataGenerator";
+	property name="configuredKeySize"             inject="coldbox:setting:saml2.keySize";
 
 // CONSTRUCTOR
 	public any function init() {
@@ -22,12 +23,12 @@ component {
 		};
 	}
 
-	public struct function generateKeyPair( expiryDays=7300, cn=_getCnForCertificates() ) {
+	public struct function generateKeyPair( expiryDays=7300, cn=_getCnForCertificates(), keySize=configuredKeySize ) {
 		var filePath     = ExpandPath( "/uploads/saml2/tmpkeystore#CreateUUId()#" );
 		var certAlias    = "generated";
 		var certPassword = CreateUUId();
 		var password     = CreateUUId();
-		var keyToolArgs  = '-genkeypair -validity #arguments.expiryDays# -alias #certAlias# -keyalg RSA -storetype JKS -keystore #filePath# -storepass #password# -keysize 2048 -keypass #certPassword# -dname CN=#arguments.cn#'.split( "\s+" );
+		var keyToolArgs  = '-genkeypair -validity #arguments.expiryDays# -alias #certAlias# -keyalg RSA -storetype JKS -keystore #filePath# -storepass #password# -keysize #arguments.keySize# -keypass #certPassword# -dname CN=#arguments.cn#'.split( "\s+" );
 
 		// TODO, replace this with a java lib for generating the keypair
 		// should keytool fail, it crashes the server :o