I kept reading that a certificate chain is about two kilobytes and kept building on that number. It is a bad habit. The chain depends on the key type, on how many intermediates the issuer ships, and on whether stapling is on.
The cheap way to stop guessing:
openssl s_client -connect example.org:443 -servername example.org -msg </dev/nullRead the byte counts on the lines the server sends. An ECDSA chain came out near 2.4 kB for me; the same host with an RSA key was close to 3.6 kB. Turning stapling on added another few hundred bytes.
A buffer downstream was sized at eight kilobytes and I wanted to know the real headroom rather than a remembered figure. It turned out to be comfortable, but I would not have known that without looking.