# Source: https://docs.datadoghq.com/security/default_rules/def-000-768.md

---
title: >-
  RSA certificates managed by AWS ACM should use a key length of at least 2,048
  bits
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > RSA certificates managed by AWS ACM
  should use a key length of at least 2,048 bits
---

# RSA certificates managed by AWS ACM should use a key length of at least 2,048 bits
 
## Description{% #description %}

This metric evaluates whether RSA certificates overseen by AWS Certificate Manager utilize a key length that is a minimum of 2,048 bits. The strength of encryption has a direct relationship with the size of the key.

## Remediation{% #remediation %}

The lower limit for the key length of RSA certificates provided by ACM is set at 2,048 bits. Directions on issuing new RSA certificates with ACM can be found in the [AWS Certificate Manager User Guide](https://docs.aws.amazon.com/acm/latest/userguide/gs.html).

Although ACM permits the import of certificates with shorter key measures, it is essential to use keys with a minimum length of 2,048 bits to comply with this guideline. The key length cannot be modified post-import. If a certificate has a key length less than 2,048 bits, it must be eliminated. For additional details on importing certificates into ACM, please refer to the [AWS Certificate Manager User Guide](https://docs.aws.amazon.com/acm/latest/userguide/import-certificate-prerequisites.html) regarding requirements for importing certificates.