Description

Ensure that AWS Certificate Manager (ACM) certificates use a secure key algorithm, such as RSA-2048 or higher, or ECDSA (P-256/P-384), and avoid weaker algorithms such as RSA-1024, which no longer provide adequate cryptographic strength.

Rationale

Certificates signed or generated with weak key algorithms and small key sizes are more susceptible to being broken with modern computing resources, undermining the confidentiality and integrity guarantees that TLS is meant to provide. Standardizing on strong key algorithms and sizes ensures that certificates issued or imported into ACM meet current cryptographic best practices for protecting data in transit.

Impact

  • Ensures TLS certificates provide an adequate level of cryptographic strength

  • Reduces the risk of certificate/key compromise via cryptanalysis or brute-force attacks

  • May require reissuing or re-importing certificates that currently use weaker algorithms

Default Value

ACM issues new public certificates using RSA-2048 by default unless a different key algorithm is explicitly requested at request time; imported certificates retain whatever key algorithm and size they were created with.

Pre-Requisites

  • IAM permissions to view and manage ACM certificates (acm:DescribeCertificate, acm:RequestCertificate)

  • Access to reissue or re-import certificates with a stronger key algorithm where needed

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Certificate Manager (ACM).

  3. Select the certificate to review.

  4. Review the Key algorithm field in the certificate details.

  5. Verify the algorithm is RSA-2048, RSA-3072, RSA-4096, or an ECDSA algorithm (EC prime256v1 / secp384r1), and not RSA-1024 or another weak algorithm.

  6. If a weak key algorithm is found, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Certificate Manager (ACM) and select Request a certificate (for ACM-issued certificates) or prepare a re-issued certificate from your certificate authority (for imported certificates).

  3. Choose a secure Key algorithm, such as RSA 2048 or an ECDSA option.

  4. Complete domain validation as required.

  5. Update the resources referencing the old certificate (for example, CloudFront distributions, ALB/NLB listeners, or API Gateway custom domains) to use the new certificate ARN.

  6. Once traffic has cut over to the new certificate, delete or allow the old, weak-algorithm certificate to be removed.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Certificate Manager (ACM).

  3. Re-attach the previous certificate ARN to the affected resources (ALB/NLB listeners, CloudFront distributions, API Gateway domains), if it has not yet been deleted.

  4. If the old certificate has been deleted, it must be re-requested or re-imported before it can be reattached.

Reference