Control: Avoid implementing too much security for certificates

Usage

Run the control in your terminal:

steampipe check net_insights.control.ssl_certificate_avoid_too_much_security

Snapshot and share results via Steampipe Cloud:

steampipe login
steampipe check --share net_insights.control.ssl_certificate_avoid_too_much_security

net_certificate

Params

["github.com","microsoft.com"]

SQL

select
  common_name as resource,
  case
    when (
      public_key_algorithm = 'RSA'
      and public_key_length > 2048
    ) then 'alarm'
    when (
      public_key_algorithm = 'ECDSA'
      and public_key_length > 256
    ) then 'alarm'
    else 'ok'
  end as status,
  case
    when (
      (
        public_key_algorithm = 'RSA'
        and public_key_length > 2048
      )
      or (
        public_key_algorithm = 'ECDSA'
        and public_key_length > 256
      )
    ) then common_name || ' is using larger keys.'
    else common_name || ' is not using larger keys.'
  end as reason
from
  net_certificate
where
  domain in (
    select
      jsonb_array_elements_text(to_jsonb($1 :: text [ ]))
  )
order by
  common_name;