We use a self-signed certificate with DSA key algorithm (and RSA signature algorithm) for securing a Kafka cluster in production. The access to the Kafka servers is already limited (by firewall) by allowing access only to specific IP subnets. The certificate generation and configs as done as mentioned in https://docs.confluent.io/2.0.0/kafka/ssl.html
But, someone strongly suggested moving to certs with RSA key algorithm and made it sound like a serious vulnerability. From reading multiple answers (like this Is the use of DSA keys a security risk?) I don't find it that bad. Should we move to RSA based cert stopping everything else we are doing?
I'm looking for a suggestion based on best practices, as I could not find proper guidelines or standards.