ACM Certificate Expired

More Info:

Ensure that all the expired Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates managed by AWS Certificate Manager are removed in order to adhere to Amazon Security Best Practices. Certificate Manager is the AWS service that lets you easily provision, manage, and deploy SSL/TLS certificates for use with other Amazon services such as Elastic Load Balancing and CloudFront.

Risk Level

High

Address

Security

Compliance Standards

NIST

Triage and Remediation

Check Cause

Using Console

Using CLI

Install and configure AWS CLI: Before you can start using AWS CLI, you need to install it on your local machine and configure it with your AWS account credentials. You can do this by running the following commands:
```
pip install awscli
aws configure
```
You will be prompted to provide your AWS Access Key ID, Secret Access Key, Default region name, and Default output format.
List all API Gateways: Use the following command to list all the API Gateways in your AWS account:
```
aws apigateway get-rest-apis
```
This command will return a list of all the REST APIs in your account.
Get the details of each API: For each API in the list, use the following command to get its details:
```
aws apigateway get-rest-api --rest-api-id {rest-api-id}
```
Replace {rest-api-id} with the ID of the API you want to check. This command will return the details of the specified API, including its name, ID, and description.
Check the ACM Certificate: In the details of each API, look for the clientCertificateId field. This field contains the ID of the ACM Certificate associated with the API. Use the following command to get the details of the certificate:
```
aws acm describe-certificate --certificate-arn {certificate-arn}
```
Replace {certificate-arn} with the ARN of the certificate you want to check. This command will return the details of the certificate, including its status and expiration date. If the status is EXPIRED, then the certificate has expired.

Using Python

Install the necessary Python libraries: To interact with AWS services, you need to install the AWS SDK for Python (Boto3). You can install it using pip:
```
pip install boto3
```
Configure AWS Credentials: Before you can begin using Boto3, you need to set up authentication credentials for your AWS account using either the AWS CLI or by creating a credentials file manually. The credentials should have permissions to access the ACM and API Gateway services.

Create a Python script to list all the API Gateways and their associated ACM certificates:

import boto3

def get_api_gateways():
    client = boto3.client('apigateway')
    response = client.get_rest_apis()
    return response['items']

def get_certificate_arn(api):
    client = boto3.client('apigateway')
    response = client.get_domain_names()
    for domain in response['items']:
        if domain['domainName'] == api['name']:
            return domain['certificateArn']
    return None

apis = get_api_gateways()
for api in apis:
    certificate_arn = get_certificate_arn(api)
    if certificate_arn:
        print(f"API: {api['name']}, Certificate ARN: {certificate_arn}")

Create a Python script to check the expiration date of the ACM certificates:

import boto3
from datetime import datetime

def get_certificate_expiration_date(certificate_arn):
    client = boto3.client('acm')
    response = client.describe_certificate(
        CertificateArn=certificate_arn
    )
    return response['Certificate']['NotAfter']

certificate_arns = [...]  # List of certificate ARNs obtained from the previous script
for arn in certificate_arns:
    expiration_date = get_certificate_expiration_date(arn)
    if expiration_date < datetime.now():
        print(f"Certificate with ARN {arn} has expired.")

This script will print out the ARN of all the ACM certificates associated with API Gateways that have expired.

Additional Reading:

https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

ACM Certificate Expired

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Additional Reading:

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Check Cause

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Check Cause

Additional Reading: