> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Rsasha1 not used by key signing key remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the RSASHA1 should not be used for key signing issue on GCP, you can follow the below steps:

        1. Open the Cloud Console and navigate to the Cloud DNS page.
        2. Select the name of the managed zone for which you want to update the DNSSEC settings.
        3. In the Security section, click on the Edit button.
        4. In the Algorithms section, uncheck the RSASHA1 checkbox.
        5. Click Save to update the DNSSEC settings.

        By unchecking the RSASHA1 checkbox, you will ensure that the RSASHA1 algorithm is not used for key signing, which will remediate the issue.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "RSASHA1 Should Not Be Used For Key Signing" misconfiguration in GCP using GCP CLI, you can follow the below steps:

        1. Open the Cloud Shell in the GCP Console.

        2. Run the following command to list all the DNS managed zones in your project:
           ```
           gcloud dns managed-zones list
           ```

        3. Choose the managed zone for which you want to remediate the misconfiguration and note down the `managed-zone-name`.

        4. Run the following command to get the DNSSEC configuration for the chosen managed zone:
           ```
           gcloud dns managed-zones describe <managed-zone-name>
           ```

        5. If the `state` field in the output shows `on`, then DNSSEC is enabled for the zone and you need to disable it.

        6. Run the following command to disable DNSSEC for the chosen managed zone:
           ```
           gcloud dns managed-zones update <managed-zone-name> --dnssec-state off
           ```

        7. Verify that the `state` field in the output of the `describe` command shows `off` to confirm that DNSSEC has been disabled for the managed zone.

        By following these steps, you can remediate the "RSASHA1 Should Not Be Used For Key Signing" misconfiguration in GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the RSASHA1 should not be used for key signing issue in GCP using Python, you can follow the below steps:

        1. Install the Google Cloud DNS Python library using the following command:

        ```
        pip install google-cloud-dns
        ```

        2. Create a DNS client object using the following code:

        ```python theme={null}
        from google.cloud import dns

        client = dns.Client()
        ```

        3. Get the DNS zone using the following code:

        ```python theme={null}
        zone_name = 'example.com.'
        zone = client.zone(zone_name)
        ```

        4. Get the DNS records using the following code:

        ```python theme={null}
        records = zone.list_resource_record_sets()
        ```

        5. Iterate over the records and check if any record uses the RSASHA1 algorithm for key signing. If found, update the record using the SHA256 algorithm using the following code:

        ```python theme={null}
        for record in records:
            if record.signature_algorithm == 'RSASHA1':
                record.signature_algorithm = 'RSASHA256'
                zone.update_record(record)
        ```

        6. Once all the records have been updated, commit the changes using the following code:

        ```python theme={null}
        zone.commit()
        ```

        By following these steps, you can remediate the RSASHA1 should not be used for key signing issue in GCP using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_dns_managed_zone" "DNS_ZONE_NAME" {
          name        = "DNS_ZONE_NAME"            # replace with your managed zone's name
          dns_name    = "EXAMPLE_DNS_NAME."        # replace with your DNS name, must end with a dot
          description = "DNS zone with secure DNSSEC configuration"

          dnssec_config {
            state = "on"

            # Key-signing key (KSK) – must NOT use RSASHA1
            default_key_specs {
              key_type  = "keySigning"
              algorithm = "rsasha256"              # change from "rsasha1" to "rsasha256"
              key_length = 2048                    # adjust if you have specific requirements
            }

            # Zone-signing key (ZSK) – example; keep or adjust as needed
            default_key_specs {
              key_type  = "zoneSigning"
              algorithm = "rsasha256"
              key_length = 1024
            }
          }
        }
        ```

        Changing the `algorithm` for `key_type = "keySigning"` from `rsasha1` to a stronger option like `rsasha256` will rotate the DNSSEC key-signing key; this does not recreate the managed zone but does trigger DNSSEC key changes and associated propagation.

        For verification, `terraform plan` should show a single `update in-place` on `google_dns_managed_zone.DNS_ZONE_NAME` with a change to `dnssec_config[0].default_key_specs[*].algorithm` from `"rsasha1"` to `"rsasha256"` for the key-signing key.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>