Zone signing should not use RSA SHA1
RSA SHA1 is a weaker algorithm than SHA2-based algorithms such as RSA SHA256/512
Impact
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Use RSA SHA512
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
resource "google_dns_managed_zone" "example-zone" {
name = "example-zone"
dns_name = "example.com."
dnssec_config {
state = "on"
default_key_specs {
algorithm = "rsasha512"
key_type = "keySigning"
}
default_key_specs {
algorithm = "rsasha512"
key_type = "zoneSigning"
}
}
}
|