|
1 | 1 | { |
2 | 2 | "Provider": "aws", |
3 | 3 | "CheckID": "acm_certificates_with_secure_key_algorithms", |
4 | | - "CheckTitle": "Check if ACM Certificates use a secure key algorithm", |
| 4 | + "CheckTitle": "ACM certificate uses a secure key algorithm", |
5 | 5 | "CheckType": [ |
6 | | - "Data Protection" |
| 6 | + "Software and Configuration Checks/AWS Security Best Practices", |
| 7 | + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", |
| 8 | + "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS", |
| 9 | + "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)" |
7 | 10 | ], |
8 | 11 | "ServiceName": "acm", |
9 | 12 | "SubServiceName": "", |
10 | | - "ResourceIdTemplate": "arn:partition:acm:region:account-id:certificate/resource-id", |
| 13 | + "ResourceIdTemplate": "", |
11 | 14 | "Severity": "high", |
12 | 15 | "ResourceType": "AwsCertificateManagerCertificate", |
13 | | - "Description": "Check if ACM Certificates use a secure key algorithm (RSA 2048 bits or more, or ECDSA 256 bits or more). For example certificates that use RSA-1024 can be compromised because the encryption could be broken in no more than 2^80 guesses making it vulnerable to a factorization attack.", |
14 | | - "Risk": "Certificates with weak RSA or ECDSA keys can be compromised because the length of the key defines the security of the encryption. The number of bits in the key determines the number of guesses an attacker would have to make in order to decrypt the data. The more bits in the key, the more secure the encryption.", |
15 | | - "RelatedUrl": "https://docs.aws.amazon.com/acm/latest/userguide/acm-certificate.html", |
| 16 | + "Description": "**ACM certificates** are evaluated for the **public key algorithm and size**, identifying those that use weak parameters such as `RSA-1024` or ECDSA `P-192`. Certificates using `RSA-2048+` or ECDSA `P-256+` meet the secure baseline.", |
| 17 | + "Risk": "**Weak certificate keys** reduce TLS confidentiality and authenticity.\n\nFeasible factoring or discrete log attacks can reveal private keys, enabling **man-in-the-middle**, session decryption, and **certificate spoofing**, leading to data exposure and tampering.", |
| 18 | + "RelatedUrl": "", |
| 19 | + "AdditionalURLs": [ |
| 20 | + "https://noise.getoto.net/2022/11/08/how-to-evaluate-and-use-ecdsa-certificates-in-aws-certificate-manager/", |
| 21 | + "https://docs.aws.amazon.com/acm/latest/userguide/data-protection.html" |
| 22 | + ], |
16 | 23 | "Remediation": { |
17 | 24 | "Code": { |
18 | 25 | "CLI": "", |
19 | | - "NativeIaC": "", |
20 | | - "Other": "", |
21 | | - "Terraform": "" |
| 26 | + "NativeIaC": "```yaml\n# CloudFormation: ACM certificate with secure key algorithm\nResources:\n <example_resource_name>:\n Type: AWS::CertificateManager::Certificate\n Properties:\n DomainName: <example_domain>\n KeyAlgorithm: EC_prime256v1 # CRITICAL: ensures a secure key algorithm (RSA-2048+ or ECDSA P-256+)\n```", |
| 27 | + "Other": "1. In the AWS Console, go to Certificate Manager (ACM)\n2. Click Request a certificate and enter <example_domain>\n3. Under Key algorithm, select ECDSA P-256 (or RSA 2048)\n4. Complete validation (DNS is recommended)\n5. In the service using the certificate (e.g., ALB/CloudFront/API Gateway), replace the old certificate with the new one\n6. Delete the insecure certificate (e.g., RSA-1024 or P-192) once no longer in use.", |
| 28 | + "Terraform": "```hcl\n# Terraform: ACM certificate with secure key algorithm\nresource \"aws_acm_certificate\" \"<example_resource_name>\" {\n domain_name = \"<example_domain>\"\n key_algorithm = \"EC_prime256v1\" # CRITICAL: ensures a secure key algorithm (RSA-2048+ or ECDSA P-256+)\n}\n```" |
22 | 29 | }, |
23 | 30 | "Recommendation": { |
24 | | - "Text": "Ensure that all ACM certificates use a secure key algorithm. If any certificates use smaller keys, regenerate them with a secure key size and update any systems that rely on these certificates.", |
25 | | - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/acm-controls.html#acm-2" |
| 31 | + "Text": "Use **strong algorithms**: `RSA-2048+` or ECDSA `P-256/P-384`. Replace weak or legacy certificates and prevent their use via policy.\n\nPrefer ECDSA where compatible, apply **least privilege** to private keys, enforce modern TLS policies, and automate renewal to maintain cryptographic strength.", |
| 32 | + "Url": "https://hub.prowler.com/check/acm_certificates_with_secure_key_algorithms" |
26 | 33 | } |
27 | 34 | }, |
28 | | - "Categories": [], |
| 35 | + "Categories": [ |
| 36 | + "encryption" |
| 37 | + ], |
29 | 38 | "DependsOn": [], |
30 | 39 | "RelatedTo": [], |
31 | 40 | "Notes": "" |
|
0 commit comments