ACM certificate should use RSA 2048 or ECDSA P-256 key algorithm
What it checks
ACM certificate should use RSA 2048 or ECDSA P-256 key algorithm
Where it applies
Terraform: aws_acm_certificate
CloudFormation: AWS::CertificateManager::Certificate
How to fix it
- Replace the certificate with key_algorithm = "RSA_2048" or "EC_prime256v1". EC_prime256v1 (ECDSA) provides faster TLS handshakes and stronger security at smaller key size.
Frameworks
- NIST 800-53 rev5 SC-12
- SOC 2 CC6.7
These mappings are advisory, not an attestation of compliance.