review module options

serverless-ca · Jan 25, 2024 · a57355a · a57355a
1 parent 5ffbc4d
commit a57355a
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/docs/security.md b/docs/security.md
@@ -4,6 +4,10 @@
 It's very important to implement your certificate authority (CA) in a secure way:
 
 * each CA should be in a dedicated AWS account
+* carefully select CA options for this module:
+    * use ECDSA algorithms rather than RSA (default)
+    * don't make CRL public unless needed (default)
+    * review other options from a security perspective
 * very carefully control AWS IAM principals and permissions 
 * restrict permissions allowing invocation of all Lambda functions
 * limit access to CA source code repository and CI/CD pipeline