Q:

Is a certificate with more bits than its parent more secure?

Let's Encrypt currently issues 4096 bit RSA certificates if requested (default, however, is 2048). But its parents, intermediate "Let's Encrypt Authority X3" and root "DST Root CA X3", are both 2048 bit.
According to this thread, the well-known Qualys SSL Labs test gives a setup with 4096 bit Let's Encrypt certificate a better rating (in "Key Exchange" section) than to 2048 bit one. Why? Isn't a certificate chain as weak as the weakest link?

A:

Neither 2048 nor 4096 bit RSA can currently be broken. Thus the question is how it affects the security of the data if the attacker sniffs the data today but manages to break the keys in the future:

The keys of the CA are only needed to validate the certificate chain. The compromise of the keys which are used for establishing a connection does not make it possible to decrypt sniffed data.
The key of the leaf certificate is used to authenticate the server which is not a problem either if the key gets compromised later. 
If RSA key exchange is used instead of the recommended DH/ECDH key exchange the key in the leaf certificate is used to protect the exchanged symmetric keys. Compromise of the RSA key will allow to remove this protection on sniffed data and thus makes it possible to decrypt sniffed traffic. In this case RSA-4096 will give more security than RSA-2048 because the efforts needed to break it are much higher. But, in practice the attacker will probably try to get to the private key not by breaking RSA but by compromising the system where the private key is stored or by using the law to get to the key. In this case RSA-2048 and RSA-4096 both provide the same security.

In summary: RSA-2048 is enough for CA certificates today. Use of RSA-4096 in a leaf certificate might in theory better than RSA-2048. In practice it is only better if RSA key exchange is used. But using this key exchange instead of DH/ECDH is not a good idea anyway because the private key of the certificate might be compromised in easier ways apart from cracking RSA.

