diff --git a/include/opendht/crypto.h b/include/opendht/crypto.h
index e5bb82eb..0a4d00c1 100644
--- a/include/opendht/crypto.h
+++ b/include/opendht/crypto.h
@@ -102,8 +102,10 @@ struct PrivateKey
 
     /**
      * Generate a new RSA key pair
+     * @param key_length : size of the modulus in bits
+     *      Recommended values: 2048, 4096, 8192
      */
-    static PrivateKey generate();
+    static PrivateKey generate(unsigned key_length = 2048);
 
 private:
     PrivateKey(const PrivateKey&) = delete;
diff --git a/src/crypto.cpp b/src/crypto.cpp
index 12ed2ce8..128a7642 100644
--- a/src/crypto.cpp
+++ b/src/crypto.cpp
@@ -376,16 +376,17 @@ Certificate::getPublicKey() const
 }
 
 PrivateKey
-PrivateKey::generate()
+PrivateKey::generate(unsigned key_length)
 {
     if (gnutls_global_init() != GNUTLS_E_SUCCESS)
         throw std::runtime_error("Can't initialize GnuTLS.");
     gnutls_x509_privkey_t key;
     if (gnutls_x509_privkey_init(&key) != GNUTLS_E_SUCCESS)
         throw std::runtime_error("Can't initialize private key.");
-    if (gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, 2048, 0) != GNUTLS_E_SUCCESS) {
+    int err = gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, key_length, 0);
+    if (err != GNUTLS_E_SUCCESS) {
         gnutls_x509_privkey_deinit(key);
-        throw std::runtime_error("Can't initialize RSA key pair.");
+        throw std::runtime_error(std::string("Can't generate RSA key pair: ") + gnutls_strerror(err));
     }
     return PrivateKey{key};
 }