All checks
Low
AWS Private CA root certificate authority should be disabled
Flags enabled root certificate authorities in AWS Private CA. Root CAs should remain disabled except when issuing certificates to subordinate CAs, to minimize exposure.
- service
- PrivateCA
- severity
- Low
- scope
- evaluated in every region
How to fix it
Disable root certificate authorities in AWS Private CA and use subordinate CAs for day-to-day operations.
- Open the AWS Private CA console.
- Select the root CA.
- Choose 'Disable' to disable the root CA.
- Use subordinate CAs for issuing end-entity certificates.
See which of your accounts this check is failing on.
Book a demo