STIGQter: STIG Summary: Apache Server 2.4 Windows Server Security Technical Implementation Guide Version: 3 Release: 4 Benchmark Date: 01 Apr 2026:

The Apache web server must only accept client DOD-approved and RFC 5280-compliant certificates.

DISA Rule

SV-214328r1192941_rule

Vulnerability Number

V-214328

Group Title

SRG-APP-000175-WSR-000095

Rule Version

AS24-W1-000380

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

Configure the web server's trust store to trust only DOD-approved PKIs (e.g., DOD PKI, DOD ECA, and DOD-approved external partners).

Edit the <'INSTALLED PATH'>\conf\extra\httpd-ssl.conf file.

Find the line "SSLVerifyDepth" and ensure it is set properly:

SSLVerifyDepth 1

Restart the Apache service.

"SSLVerifyDepth" is set based on the number of CAs that are required in the certificate chain to check before the client certificate is accepted as valid. A setting of "0" would allow self-signed CAs to validate client certificates, which is not desirable in this context.

Additional Information:
https://httpd.apache.org/docs/current/mod/mod_ssl.html

Check Contents

Review the <'INSTALLED PATH'>\conf\extra\httpd-ssl.conf file to determine if the "SSLVerifyDepth" and "SSLCACertificateFile" directives exist.

SSLVerifyDepth 1

If "SSLVerifyDepth" is set to "0", this is a finding.

Look for the "SSLCACertificateFile" directive.

Review the path of the "SSLCACertificateFile" directive.

Review the contents of <'path of cert'>\ca-bundle.crt.

Examine the contents of this file to determine if the trusted CAs are DOD-approved. If the trusted CA that is used to authenticate users to the website does not lead to an approved DOD CA, this is a finding.

NOTE: There are non-DOD roots that must be on the server for it to function. Some applications, such as antivirus programs, require root CAs to function. DOD-approved certificates can include the External Certificate Authorities (ECA), if approved by the authorizing official (AO). The PKE InstallRoot 3.06 System Administrator Guide (SAG), dated 08 Jul 2008, contains a complete list of DOD, ECA, and IECA CAs.

Vulnerability Number

V-214328

Documentable

False

Rule Version

AS24-W1-000380

Severity Override Guidance

Review the <'INSTALLED PATH'>\conf\extra\httpd-ssl.conf file to determine if the "SSLVerifyDepth" and "SSLCACertificateFile" directives exist.

SSLVerifyDepth 1

If "SSLVerifyDepth" is set to "0", this is a finding.

Look for the "SSLCACertificateFile" directive.

Review the path of the "SSLCACertificateFile" directive.

Review the contents of <'path of cert'>\ca-bundle.crt.

Examine the contents of this file to determine if the trusted CAs are DOD-approved. If the trusted CA that is used to authenticate users to the website does not lead to an approved DOD CA, this is a finding.

NOTE: There are non-DOD roots that must be on the server for it to function. Some applications, such as antivirus programs, require root CAs to function. DOD-approved certificates can include the External Certificate Authorities (ECA), if approved by the authorizing official (AO). The PKE InstallRoot 3.06 System Administrator Guide (SAG), dated 08 Jul 2008, contains a complete list of DOD, ECA, and IECA CAs.

Check Content Reference

M

Target Key

3998