Back to Checks
aws

AWS Private CA certificate authorities use a post-quantum (ML-DSA) key algorithm

acmpca_certificate_authority_pqc_key_algorithm
Service: acmpcaSeverity: low
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsAcmPcaCertificateAuthority

AWS Private Certificate Authorities (Private CAs) are assessed for use of a post-quantum digital signature key algorithm (ML_DSA_44, ML_DSA_65, ML_DSA_87). CAs that still issue certificates with RSA or ECC algorithms produce signatures vulnerable to forgery once a cryptographically relevant quantum computer is available.

Prowler logoProwlerprowler-provider-aws

Risk

RSA and ECC signatures can be broken by Shor's algorithm on a sufficiently large quantum computer. A compromised CA private key would let an attacker issue arbitrary certificates trusted across the PKI, undermining identity and code-signing controls. Migrating CAs to ML-DSA (NIST FIPS 204) provides quantum-resistant signatures so issued certificates retain integrity in the post-quantum era.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks acmpca_certificate_authority_pqc_key_algorithm

Recommendation

Create new Private CAs with a post-quantum key algorithm (ML_DSA_44, ML_DSA_65, or ML_DSA_87) and migrate workloads off legacy RSA/ECC CAs. Plan crypto-agility for your PKI so that quantum-resistant trust anchors can be rolled out before threat actors gain access to a cryptographically relevant quantum computer.

Remediation

CLI

aws acm-pca create-certificate-authority --certificate-authority-configuration '{"KeyAlgorithm":"ML_DSA_65","SigningAlgorithm":"ML_DSA_65","Subject":{...}}' --certificate-authority-type SUBORDINATE

Terraform

resource "aws_acmpca_certificate_authority" "<example_resource_name>" {
  type = "SUBORDINATE"
  certificate_authority_configuration {
    key_algorithm     = "ML_DSA_65" # FIX: post-quantum signature algorithm
    signing_algorithm = "ML_DSA_65"
    subject {
      common_name = "example-pqc-ca"
    }
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::ACMPCA::CertificateAuthority
    Properties:
      Type: SUBORDINATE
      KeyAlgorithm: ML_DSA_65        # FIX: post-quantum signature algorithm
      SigningAlgorithm: ML_DSA_65
      Subject:
        CommonName: example-pqc-ca

Other

1Existing CAs cannot have their key algorithm changed; create a new CA with KeyAlgorithm = ML_DSA_44 / ML_DSA_65 / ML_DSA_87, re-issue certificates from it, and decommission the legacy CA once dependent workloads have rotated.

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.acmpca.acmpca_client import acmpca_client

PQC_PCA_KEY_ALGORITHMS_DEFAULT = [
    "ML_DSA_44",
    "ML_DSA_65",
    "ML_DSA_87",
]


class acmpca_certificate_authority_pqc_key_algorithm(Check):
    """Verify that every AWS Private CA uses a post-quantum key algorithm.

    A Private CA PASSES when its ``KeyAlgorithm`` belongs to the configured
    allowlist of post-quantum signature algorithms (ML-DSA family).
    Deleted CAs are skipped.
    """

    def execute(self) -> list[Check_Report_AWS]:
        """Execute the check against AWS Private CAs.

        Returns:
            A list of reports with each non-deleted CA PQC key algorithm status.
        """

        findings = []
        pqc_algorithms = acmpca_client.audit_config.get(
            "acmpca_pqc_key_algorithms", PQC_PCA_KEY_ALGORITHMS_DEFAULT
        )
        for ca in acmpca_client.certificate_authorities.values():
            if ca.status == "DELETED":
                continue
            report = Check_Report_AWS(metadata=self.metadata(), resource=ca)
            algorithm = ca.key_algorithm or "<none>"
            if ca.key_algorithm in pqc_algorithms:
                report.status = "PASS"
                report.status_extended = (
                    f"AWS Private CA {ca.id} uses post-quantum key algorithm "
                    f"{algorithm}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"AWS Private CA {ca.id} uses key algorithm {algorithm}, "
                    "which is not post-quantum (ML-DSA)."
                )
            findings.append(report)

        return findings

References