# Ensure ACM Certificates Use a Secure Key Algorithm

- Source: https://support.icompaas.com/support/solutions/articles/a_178889001564994-ensure-acm-certificates-use-a-secure-key-algorithm
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that AWS Certificate Manager (ACM) certificates use a secure key algorithm, such as RSA-2048 or higher, or ECDSA (P-256/P-384), and avoid weaker algorithms such as RSA-1024, which no longer provide adequate cryptographic strength.

**Rationale**

Certificates signed or generated with weak key algorithms and small key sizes are more susceptible to being broken with modern computing resources, undermining the confidentiality and integrity guarantees that TLS is meant to provide. Standardizing on strong key algorithms and sizes ensures that certificates issued or imported into ACM meet current cryptographic best practices for protecting data in transit.

**Impact**

-   Ensures TLS certificates provide an adequate level of cryptographic strength
    
-   Reduces the risk of certificate/key compromise via cryptanalysis or brute-force attacks
    
-   May require reissuing or re-importing certificates that currently use weaker algorithms
    

**Default Value**

ACM issues new public certificates using RSA-2048 by default unless a different key algorithm is explicitly requested at request time; imported certificates retain whatever key algorithm and size they were created with.

**Pre-Requisites**

-   IAM permissions to view and manage ACM certificates (acm:DescribeCertificate, acm:RequestCertificate)
    
-   Access to reissue or re-import certificates with a stronger key algorithm where needed
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Certificate Manager (ACM).
    
3.  Select the certificate to review.
    
4.  Review the Key algorithm field in the certificate details.
    
5.  Verify the algorithm is RSA-2048, RSA-3072, RSA-4096, or an ECDSA algorithm (EC prime256v1 / secp384r1), and not RSA-1024 or another weak algorithm.
    
6.  If a weak key algorithm is found, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Certificate Manager (ACM) and select Request a certificate (for ACM-issued certificates) or prepare a re-issued certificate from your certificate authority (for imported certificates).
    
3.  Choose a secure Key algorithm, such as RSA 2048 or an ECDSA option.
    
4.  Complete domain validation as required.
    
5.  Update the resources referencing the old certificate (for example, CloudFront distributions, ALB/NLB listeners, or API Gateway custom domains) to use the new certificate ARN.
    
6.  Once traffic has cut over to the new certificate, delete or allow the old, weak-algorithm certificate to be removed.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS Certificate Manager (ACM).
    
3.  Re-attach the previous certificate ARN to the affected resources (ALB/NLB listeners, CloudFront distributions, API Gateway domains), if it has not yet been deleted.
    
4.  If the old certificate has been deleted, it must be re-requested or re-imported before it can be reattached.
    

**Reference**

-   [https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html](https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html)
    
-   [https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate-characteristics.html](https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate-characteristics.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.