AWS Private CA root certificate authority should be disabled

Checks that an AWS Private CA root certificate authority is disabled; a root in any other state fails, and only an active one can be disabled. The root should only sign subordinate CA certificates, so keeping it disabled leaves the subordinates to issue end-entity certificates and the root out of harm's way.

service: PrivateCA
severity: Low
scope: evaluated in every region

How to fix it

Interrupts service: A disabled CA issues no certificates, including subordinate CA certificates and their renewals, though it still answers OCSP, publishes CRLs and can revoke.

In the console

AWS Private CA → Private certificate authorities → the CA → Actions

Disable: Whenever the root is not signing a subordinate CA certificate; Enable it again only to sign one

With the AWS CLI

aws acm-pca update-certificate-authority --certificate-authority-arn <ca-arn> --status DISABLED --region <region>

With Terraform

resource "aws_acmpca_certificate_authority" "this" {
  type    = "ROOT"
  enabled = false

  certificate_authority_configuration {
    key_algorithm     = "RSA_4096"
    signing_algorithm = "SHA512WITHRSA"

    subject {
      common_name = var.common_name
    }
  }
}

See which of your accounts this check is failing on.

Book a live scan