Skip to main content

🛡️ AWS ACM RSA Certificate key length is less than 2048 bits🟢

  • Contextual name: 🛡️ RSA Certificate key length is less than 2048 bits🟢
  • ID: /ce/ca/aws/acm/rsa-certificate-key-length-less-than-2048-bits
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

  • Internal: dec-x-4de1c44e

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-4de1c44e1

Description​

Open File

Description​

All RSA certificates managed by AWS Certificate Manager (ACM) must have a key length of at least 2048 bits. This includes certificates imported into ACM by users. Ensuring the use of 2048-bit keys enhances certificate security, aligns with modern cryptographic standards, and reduces vulnerabilities to brute-force attacks.

Rationale​

The use of RSA keys with a minimum length of 2048 bits provides stronger encryption, improving the security posture of applications and services relying on ACM-managed certificates. Shorter keys are more susceptible to cryptographic attacks, which could compromise sensitive data.

Impact​

May require updates to legacy systems or certificates.

Audit​

This policy flags an AWS ACM Certificate as INCOMPLIANT if the Key Algorithm is RSA-1024 and the Status field is set to Issued.

If the Status field is not Issued, the certificate will be marked as INAPPLICABLE.

Remediation​

Open File

Remediation​

It is not possible to change the key length of a certificate after it has been imported. Instead, delete certificates with a key length smaller than 2,048 bits.

Note: You cannot delete an ACM certificate that is in use by another AWS service. To delete such a certificate, you must first remove its association with the service.

From Command Line​

Use the delete-certificate command to remove a certificate:

aws acm delete-certificate --certificate-arn {{certificate-arn}}

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits11no data
💼 Cloudaware Framework → 💼 Cryptographic Configuration9no data
💼 PCI DSS v3.2.1 → 💼 4.1 Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks.1828no data
💼 PCI DSS v4.0.1 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.228no data
💼 PCI DSS v4.0 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.2928no data