def validate_key_algorithm(key_algorithm):
    """
    CertificateAuthority KeyAlgorithm validation rule.
    Property: CertificateAuthority.KeyAlgorithm
    """

    VALID_KEY_ALGORITHM = ("EC_prime256v1", "EC_secp384r1", "RSA_2048", "RSA_4096")

    if key_algorithm not in VALID_KEY_ALGORITHM:
        raise ValueError(
            "CertificateAuthority KeyAlgorithm must be one of: %s"
            % ", ".join(VALID_KEY_ALGORITHM)  # NOQA
        )
    return key_algorithm