Skip to main content

🛡️ AWS ACM RSA Certificate key length is less than 2048 bits🟢

  • Contextual name: 🛡️ RSA Certificate key length is less than 2048 bits🟢
  • ID: /ce/ca/aws/acm/rsa-certificate-key-length-less-than-2048-bits
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

  • Internal: dec-x-4de1c44e

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-4de1c44e1

Description​

Open File

Description​

All RSA certificates managed by AWS Certificate Manager (ACM) must have a key length of at least 2048 bits. This includes certificates imported into ACM by users. Ensuring the use of 2048-bit keys enhances the security of the certificates, aligning with modern cryptographic standards and reducing vulnerabilities to brute-force attacks.

Rationale​

The use of RSA keys with a minimum length of 2048 bits provides stronger encryption, improving the security posture of applications and services relying on ACM-managed certificates. Shorter keys are more susceptible to cryptographic attacks, which could compromise sensitive data.

Impact​

May require updates to legacy systems or certificates.

Audit​

This policy will mark a certificate as INCOMPLIANT if the Key Algorithm is RSA-1024 and the Status field is set to Issued.

If the Status field is not Issued, the certificate will be marked as INAPPLICABLE.

Remediation​

Open File

Remediation​

It is not possible to change the key length of a certificate after it has been imported. Instead, delete certificates with a key length smaller than 2,048 bits.

Note: You cannot delete an ACM certificate that is in use by another AWS service. To delete such a certificate, you must first remove its association with the service.

From Command Line​

Use the delete-certificate command to remove a certificate:

aws acm delete-certificate --certificate-arn {{certificate-arn}}

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits11no data
💼 Cloudaware Framework → 💼 Cryptographic Configuration8no data
💼 PCI DSS v3.2.1 → 💼 4.1 Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks.1821no data
💼 PCI DSS v4.0.1 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.221no data
💼 PCI DSS v4.0 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.2921no data