Help Center/ Config/ User Guide/ Resource Compliance/ Built-In Policies/ Cloud Certificate Manager/ Private CA Algorithm Check
Updated on 2024-12-10 GMT+08:00
View PDF
Share

Private CA Algorithm Check

Rule Details

Table 1 Rule details

Parameter

Description

Rule Name

pca-algorithm-check

Identifier

Algorithm Check

Description

If a private certificate or CA prohibits key-based algorithms or signature-based hash algorithms, the private certificate or CA is noncompliant.

Tag

pca

Trigger Type

Configuration change

Filter Type

pca.ca, pca.cert

Configure Rule Parameters
  • blockedKeyAlgorithm: key algorithms. The value must be an array, for example, ["SM2", "RSA2048", "EC256"].
  • blockedSignatureAlgorithm: signature algorithms. The value must be an array, for example, ["SHA256"].

Applicable Scenario

Secure algorithms are critical for private CA and certificate security. You are advised to use algorithms that can ensure enough security for your resources. This will not costs much as they used to.

Solution

You can remove noncompliant private CAs and certificates, and purchase new ones that meet your security requirements.

Rule Logic

  • If a private certificate or CA prohibits key-based algorithms or signature-based hash algorithms, the private certificate or CA is noncompliant.
  • If a private certificate or CA does not prohibit key-based algorithms or signature-based hash algorithms, the private certificate or CA is compliant.