Description

Ensure that every certificate issued by AWS Certificate Manager (ACM) and in use has Certificate Transparency (CT) logging enabled. CT logging records each issued certificate in public, append-only logs so that domain owners can detect certificates issued for their domains. Imported certificates are not covered by this setting, and certificates that are not in use are not evaluated.

Rationale

Certificate Transparency allows domain owners to detect mistakenly or maliciously issued certificates that could be used to impersonate their websites or intercept TLS traffic. Disabling CT logging removes this visibility. In addition, major browsers such as Google Chrome and Apple Safari do not trust public certificates that are not recorded in CT logs, so users may see security errors when visiting the site.

Impact

  • Allows detection of misissued or rogue certificates for your domains

  • Ensures browsers trust the certificate and users do not receive security warnings

  • Domain names in the certificate become publicly visible in CT logs

Default Value

Certificate Transparency logging is enabled by default for all public certificates issued by ACM.

Pre-Requisites

  • IAM permissions: acm:ListCertificates, acm:DescribeCertificate and acm:UpdateCertificateOptions

  • Confirmation that the domain names in the certificate may be publicly visible in CT logs

Remediation

Test Plan

The ACM console does not show the Certificate Transparency logging preference of an existing certificate. This setting is managed with the AWS CLI or API.

CLI:

Show the CT logging setting of a certificate (repeat for each certificate in each region in use):

aws acm describe-certificate --certificate-arn <CERTIFICATE_ARN> --query "Certificate.[DomainName,Type,Options.CertificateTransparencyLoggingPreference]" --output table

A certificate in use whose Type is not IMPORTED fails if CertificateTransparencyLoggingPreference is not ENABLED. Imported certificates always pass, and certificates that are not in use are not evaluated.

Implementation Steps

The ACM console cannot change the Certificate Transparency logging preference of an existing certificate. This setting is managed with the AWS CLI or API.

CLI:

Enable CT logging for a certificate (repeat for each affected certificate in each region in use):

aws acm update-certificate-options --certificate-arn <CERTIFICATE_ARN> --options CertificateTransparencyLoggingPreference=ENABLED

Backout Plan

The Certificate Transparency logging preference cannot be changed in the ACM console. It is managed with the AWS CLI or API.

CLI:

Disable CT logging for a certificate:

aws acm update-certificate-options --certificate-arn <CERTIFICATE_ARN> --options CertificateTransparencyLoggingPreference=DISABLED

Note: a certificate that has already been recorded in a CT log cannot be removed from it. Disabling logging may also cause browsers to distrust the certificate.

Reference