AWS Certificate Manager controls
These controls are related to ACM resources.
These controls may not be available in all AWS Regions. For more information, see Availability of controls by Region.
[ACM.1] Imported and ACM-issued certificates should be renewed after a specified time period
Related requirements: NIST.800-53.r5 SC-28(3), NIST.800-53.r5 SC-7(16)
Category: Protect > Data protection > Encryption of data in transit
Severity: Medium
Resource type:
AWS::ACM::Certificate
AWS Config rule:
acm-certificate-expiration-check
Schedule type: Change triggered and periodic
Parameters:
| Parameter | Description | Type | Allowed custom values | Security Hub default value |
|---|---|---|---|---|
|
|
Number of days within which the ACM certificate must be renewed |
Integer |
|
|
This control checks whether an AWS Certificate Manager (ACM) certificate is renewed within the specified time period. It checks both imported certificates and certificates provided by ACM. The control fails if the certificate isn't renewed within the specified time period. Unless you provide a custom parameter value for the renewal period, Security Hub uses a default value of 30 days.
ACM can automatically renew certificates that use DNS validation. For certificates that use email validation, you must respond to a domain validation email. ACM doesn't automatically renew certificates that you import. You must renew imported certificates manually.
Remediation
ACM provides managed renewal for your SSL/TLS certificates issued by Amazon. This means that ACM either renews your certificates automatically (if you use DNS validation), or it sends you email notices when the certificate expiration approaches. These services are provided for both public and private ACM certificates.
- For domains validated by email
-
When a certificate is 45 days from expiration, ACM sends to the domain owner an email for each domain name. To validate the domains and complete the renewal, you must respond to the email notifications.
For more information, see Renewal for domains validated by email in the AWS Certificate Manager User Guide.
- For domains validated by DNS
-
ACM automatically renews certificates that use DNS validation. 60 days before the expiration, ACM verifies that the certificate can be renewed.
If it cannot validate a domain name, then ACM sends a notification that manual validation is required. It sends these notifications 45 days, 30 days, 7 days, and 1 day before the expiration.
For more information, see Renewal for domains validated by DNS in the AWS Certificate Manager User Guide.
[ACM.2] RSA certificates managed by ACM should use a key length of at least 2,048 bits
Category: Identify > Inventory > Inventory services
Severity: High
Resource type:
AWS::ACM::Certificate
AWS Config rule:
acm-certificate-rsa-check
Schedule type: Change triggered
Parameters: None
This control checks whether RSA certificates managed by AWS Certificate Manager use a key length of at least 2,048 bits. The control fails if the key length is smaller than 2,048 bits.
The strength of encryption directly correlates with key size. We recommend key lengths of at least 2,048 bits to protect your AWS resources as computing power becomes less expensive and servers become more advanced.
Remediation
The minimum key length for RSA certificates issued by ACM is already 2,048 bits. For instructions on issuing new RSA certificates with ACM, see Issuing and managing certificates in the AWS Certificate Manager User Guide.
While ACM allows you to import certificates with shorter key lengths, you must use keys of at least 2,048 bits to pass this control. You can't change the key length after importing a certificate. Instead, you must delete certificates with a key length smaller than 2,048 bits. For more information about importing certificates into ACM, see Prerequisites for importing certificates in the AWS Certificate Manager User Guide.
