Check ID: acm_certificates_with_secure_key_algorithms
Provider: AWS
Service: acm
Severity: HIGH
Categories: encryption
Resource type: AwsCertificateManagerCertificate

​
What this check verifies

ACM certificates are evaluated for the public key algorithm and size, identifying those that use weak parameters such as RSA-1024 or ECDSA P-192. Certificates using RSA-2048+ or ECDSA P-256+ meet the secure baseline.

​
Risk

Weak certificate keys reduce TLS confidentiality and authenticity. Feasible factoring or discrete log attacks can reveal private keys, enabling man-in-the-middle, session decryption, and certificate spoofing, leading to data exposure and tampering.

​
Recommendation

Use strong algorithms: RSA-2048+ or ECDSA P-256/P-384. Replace weak or legacy certificates and prevent their use via policy. Prefer ECDSA where compatible, apply least privilege to private keys, enforce modern TLS policies, and automate renewal to maintain cryptographic strength.

​
Remediation

# Terraform: ACM certificate with secure key algorithm
resource "aws_acm_certificate" "<example_resource_name>" {
  domain_name   = "<example_domain>"
  key_algorithm = "EC_prime256v1"  # CRITICAL: ensures a secure key algorithm (RSA-2048+ or ECDSA P-256+)
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = acm_certificates_with_secure_key_algorithms. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks