Skip to main content

ACM Certificates Should Have Minimum RSA Length

More Info:​

Ensure ACM certificate RSA length is minimum of 2048

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • StateRAMP
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Check Cause​

Using Console
  1. Sign in to the AWS Management Console.
  2. Navigate to the API Gateway console. You can do this by typing "API Gateway" into the search bar and selecting it from the dropdown menu.
  3. Once in the API Gateway console, select the API you want to check.
  4. In the API's settings, look for the ACM Certificate section. Here, you can see the RSA length of the certificate. If the RSA length is less than the minimum required length, then there is a misconfiguration.
Using CLI

  1. First, you need to list all the API Gateways in your AWS account. You can do this by using the following AWS CLI command:

    aws apigateway get-rest-apis --region your-region

    Replace 'your-region' with the region you want to check. This command will return a list of all the API Gateways in the specified region.

  2. Next, for each API Gateway, you need to get the details of the associated ACM certificate. You can do this by using the following AWS CLI command:

    aws apigateway get-domain-names --region your-region

    This command will return a list of all the domain names associated with each API Gateway. Each domain name will have an associated ACM certificate.

  3. Now, for each ACM certificate, you need to get the details of the certificate. You can do this by using the following AWS CLI command:

    aws acm describe-certificate --certificate-arn your-certificate-arn --region your-region

    Replace 'your-certificate-arn' with the ARN of the certificate you want to check. This command will return the details of the specified certificate.

  4. Finally, you need to check the RSA length of the certificate. You can do this by looking at the 'KeyAlgorithm' field in the output of the previous command. If the 'KeyAlgorithm' field is 'RSA_2048', then the RSA length of the certificate is 2048 bits. If the 'KeyAlgorithm' field is 'RSA_1024', then the RSA length of the certificate is 1024 bits. If the RSA length is less than 2048 bits, then the certificate is misconfigured.

Using Python

  1. Install the necessary Python libraries: Before you start, make sure you have the necessary Python libraries installed. You will need 'boto3' for AWS SDK for Python and 'botocore' for low-level, core functionality of AWS SDK for Python. You can install these libraries using pip:

    pip install boto3 botocore

  2. Import the necessary libraries and initialize the AWS service: Import the necessary Python libraries and initialize the AWS service you want to use. In this case, we are using 'boto3' to interact with AWS API Gateway and ACM (AWS Certificate Manager).

    import boto3

    # Create a client for the AWS service.
    apigateway = boto3.client('apigateway')
    acm = boto3.client('acm')

  3. Get the list of API Gateways and their associated ACM Certificates: Use the 'get_rest_apis' function to get the list of API Gateways. Then, for each API Gateway, get the associated ACM Certificate using the 'get_domain_name' function.

    # Get the list of API Gateways.
    api_gateways = apigateway.get_rest_apis()['items']

    for api_gateway in api_gateways:
        # Get the domain name associated with the API Gateway.
        domain_name = apigateway.get_domain_name(domainName=api_gateway['name'])
        
        # Get the ACM Certificate associated with the domain name.
        certificate_arn = domain_name['domainName']['certificateArn']
        certificate = acm.describe_certificate(CertificateArn=certificate_arn)

  4. Check the RSA length of the ACM Certificate: The RSA length of the ACM Certificate can be found in the 'KeyAlgorithm' field of the certificate description. If the RSA length is less than the minimum required length, print a warning message.

    # Check the RSA length of the ACM Certificate.
    if 'RSA' in certificate['Certificate']['KeyAlgorithm']:
        rsa_length = int(certificate['Certificate']['KeyAlgorithm'].split('_')[1])
        if rsa_length < 2048:
            print(f"Warning: The ACM Certificate for API Gateway {api_gateway['name']} has an RSA length of {rsa_length}, which is less than the minimum required length of 2048.")

This script will help you detect if any ACM Certificates associated with API Gateways have an RSA length less than the minimum required length.