Back to Checks
aws

ACM certificate uses a secure key algorithm

acm_certificates_with_secure_key_algorithms
Service: acmSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsCertificateManagerCertificate

ACM certificates are evaluated for the public key algorithm and size, identifying those that use weak parameters such as RSA-1024 or ECDSA P-192. Certificates using RSA-2048+ or ECDSA P-256+ meet the secure baseline.

Prowler logoProwlerprowler-provider-aws

Risk

Weak certificate keys reduce TLS confidentiality and authenticity.

Feasible factoring or discrete log attacks can reveal private keys, enabling man-in-the-middle, session decryption, and certificate spoofing, leading to data exposure and tampering.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks acm_certificates_with_secure_key_algorithms

Recommendation

Use strong algorithms: RSA-2048+ or ECDSA P-256/P-384. Replace weak or legacy certificates and prevent their use via policy.

Prefer ECDSA where compatible, apply least privilege to private keys, enforce modern TLS policies, and automate renewal to maintain cryptographic strength.

Remediation

Terraform

# Terraform: ACM certificate with secure key algorithm
resource "aws_acm_certificate" "<example_resource_name>" {
  domain_name   = "<example_domain>"
  key_algorithm = "EC_prime256v1"  # CRITICAL: ensures a secure key algorithm (RSA-2048+ or ECDSA P-256+)
}

NativeIaC

# CloudFormation: ACM certificate with secure key algorithm
Resources:
  <example_resource_name>:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: <example_domain>
      KeyAlgorithm: EC_prime256v1  # CRITICAL: ensures a secure key algorithm (RSA-2048+ or ECDSA P-256+)

Other

1In the AWS Console, go to Certificate Manager (ACM)
2Click Request a certificate and enter <example_domain>
3Under Key algorithm, select ECDSA P-256 (or RSA 2048)
4Complete validation (DNS is recommended)
5In the service using the certificate (e.g., ALB/CloudFront/API Gateway), replace the old certificate with the new one
6Delete the insecure certificate (e.g., RSA-1024 or P-192) once no longer in use.

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.acm.acm_client import acm_client


class acm_certificates_with_secure_key_algorithms(Check):
    def execute(self):
        findings = []
        for certificate in acm_client.certificates.values():
            if certificate.in_use or acm_client.provider.scan_unused_services:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=certificate
                )

                report.status = "PASS"
                report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} uses a secure key algorithm ({certificate.key_algorithm})."
                if certificate.key_algorithm in acm_client.audit_config.get(
                    "insecure_key_algorithms", ["RSA-1024", "P-192"]
                ):
                    report.status = "FAIL"
                    report.status_extended = f"ACM Certificate {certificate.id} for {certificate.name} does not use a secure key algorithm ({certificate.key_algorithm})."
                findings.append(report)

        return findings

References