> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Rsasha1 not used by zone signing key remediation ### Triage and Remediation ### Remediation To remediate the "RSASHA1 Should Not Be Used For Zone Signing" misconfiguration for GCP using GCP console, you can follow the below steps: 1. Open the Google Cloud Console and select the project where the zone is located. 2. In the navigation menu, select "Network services" and then "Cloud DNS". 3. Select the DNS zone for which you want to remediate the misconfiguration. 4. In the "DNSSEC" tab, check the status of your DNSSEC configuration. If it is not enabled, enable it by clicking on "Enable DNSSEC". 5. Once DNSSEC is enabled, click on "Manage Keys" to view the keys used for signing the zone. 6. Check if the key algorithm is set to "RSASHA1". If it is, then you need to create a new key with a stronger algorithm. 7. To create a new key, click on "Add Key" and select a stronger algorithm like "RSASHA256" or "ECDSAP256SHA256". 8. Once the new key is created, set it as the active key by clicking on the "Set Active" button next to it. 9. Finally, re-sign the zone by clicking on "Re-sign Zone". This will ensure that the new key is used for signing the zone and the RSASHA1 algorithm is no longer used. By following these steps, you can remediate the "RSASHA1 Should Not Be Used For Zone Signing" misconfiguration for GCP using GCP console. # To remediate the "RSASHA1 Should Not Be Used For Zone Signing" misconfiguration in GCP using GCP CLI, you can follow the steps below: 1. Open the Cloud Shell in GCP Console. 2. Run the following command to list all the managed zones in your project: ``` gcloud dns managed-zones list ``` 3. Choose the managed zone that you want to update and note down its name. 4. Run the following command to update the DNSSEC algorithm for the chosen managed zone: ``` gcloud dns managed-zones update [MANAGED_ZONE_NAME] --dnssec-algorithm=RSASHA256 ``` Note: Replace \[MANAGED\_ZONE\_NAME] with the name of the managed zone that you want to update. 5. Verify that the DNSSEC algorithm has been updated successfully by running the following command: ``` gcloud dns managed-zones describe [MANAGED_ZONE_NAME] --format="value(dnssecConfig.defaultKeySpecs[0].algorithm)" ``` Note: Replace \[MANAGED\_ZONE\_NAME] with the name of the managed zone that you updated in Step 4. The output of this command should be "RSASHA256", which indicates that the DNSSEC algorithm has been updated successfully. 6. Repeat Steps 4 and 5 for all the managed zones in your project. By following these steps, you can remediate the "RSASHA1 Should Not Be Used For Zone Signing" misconfiguration in GCP using GCP CLI. To remediate the "RSASHA1 Should Not Be Used For Zone Signing" issue for GCP using Python, you can follow the below steps: 1. First, you need to authenticate to GCP using the Google Cloud SDK and set up a project. 2. Next, you need to install the Google Cloud DNS API client library for Python using the following command: ``` pip install google-cloud-dns ``` 3. Once the library is installed, you can write a Python script to retrieve the DNS zone for which you want to remediate the issue. You can use the following code snippet: ``` from google.cloud import dns # Authenticate to GCP client = dns.Client() # Retrieve the DNS zone zone_name = 'example.com.' zone = client.zone(zone_name) ``` 4. Once you have retrieved the DNS zone, you can update the zone signing algorithm to use a more secure algorithm. You can use the following code snippet to update the zone signing algorithm to RSASHA256: ``` from google.cloud.dns import record # Update the zone signing algorithm zone.dnssec_config.default_key_spec = record.RSASHA256 zone.update() ``` 5. Finally, you can verify that the zone signing algorithm has been updated by retrieving the DNS zone and checking the default key specification: ``` # Retrieve the DNS zone zone = client.zone(zone_name) # Check the default key specification default_key_spec = zone.dnssec_config.default_key_spec print(f'Default key specification: {default_key_spec}') ``` By following these steps, you can remediate the "RSASHA1 Should Not Be Used For Zone Signing" issue for GCP using Python. ```hcl theme={null} resource "google_dns_managed_zone" "DNS_ZONE" { name = "DNS_ZONE_NAME" # e.g. "prod-example-com" dns_name = "DNS_NAME." # e.g. "example.com." description = "DESCRIPTION_OF_ZONE" # Ensure DNSSEC is enabled and does NOT use RSASHA1 for the zone-signing key dnssec_config { state = "on" default_key_specs { key_type = "KEY_SIGNING" algorithm = "rsasha256" # or "ecdsap256sha256", but NOT "rsasha1" key_length = 2048 } default_key_specs { key_type = "ZONE_SIGNING" algorithm = "rsasha256" # or "ecdsap256sha256", but NOT "rsasha1" key_length = 1024 } } } ``` Substitute: * `DNS_ZONE` with your Terraform resource name. * `DNS_ZONE_NAME` with the managed zone name in Cloud DNS. * `DNS_NAME` with the DNS suffix for the zone. * `DESCRIPTION_OF_ZONE` with a suitable description. This change updates the DNSSEC configuration in-place (no managed zone replacement) to use a stronger algorithm for the zone-signing key. After editing, `terraform plan` should show an in-place update to the `dnssec_config.default_key_specs` algorithm values from `rsasha1` to `rsasha256` (or your chosen non-RSASHA1 algorithm), with no `-/+` replacement of the `google_dns_managed_zone` resource.