Missing Security Settings on Zitadel Cloud
❓Question☁️Zitadel Cloud✅Solved
Is there a reason why zitadel.cloud only uses a weak 1024-bit RSA ZSK for DNSSEC? It got flagged when doing our TLS Audit:
"RSA key size is too small
Zone zitadel.cloud uses a 1024-bit RSA ZSK (key tag 5244). Keys under 2048 bits are considered factorable with sufficient resources. Upgrade to 2048-bit minimum or migrate to ECDSA."
Also, would it be possible to configure PQC for custom domains on Zitadel Cloud? And also disable weak ciphers TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA as they are still allowed by the GCP ssl policy you use for Zitadel Cloud on the custom domain, but they should not be (https://ciphersuite.info/cs/TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA/, https://ciphersuite.info/cs/TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA/)
"RSA key size is too small
Zone zitadel.cloud uses a 1024-bit RSA ZSK (key tag 5244). Keys under 2048 bits are considered factorable with sufficient resources. Upgrade to 2048-bit minimum or migrate to ECDSA."
Also, would it be possible to configure PQC for custom domains on Zitadel Cloud? And also disable weak ciphers TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA as they are still allowed by the GCP ssl policy you use for Zitadel Cloud on the custom domain, but they should not be (https://ciphersuite.info/cs/TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA/, https://ciphersuite.info/cs/TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA/)
A searchable directory of TLS ciphersuites
