STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application, when utilizing PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

DISA Rule

SV-222550r508029_rule

Vulnerability Number

V-222550

Group Title

SRG-APP-000175

Rule Version

APSC-DV-001810

Severity

CAT I

CCI(s)

• CCI-000185 - The information system, for PKI-based authentication, validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

Design the application to construct a certification path to an accepted trust anchor when using PKI-based authentication.

Check Contents

Review the application documentation, the application architecture and interview the application administrator to identify the method employed by the application for validating certificates.

Review the method to determine if a certification path that includes status information is constructed when certificate validation occurs.

Some applications may utilize underlying OS certificate validation and certificate path building capabilities while others may build the capability into the application itself.

The certification path will include the intermediary certificate CAs along with a status of the CA server's signing certificate and will end at the trusted root anchor.

If the application does not construct a certificate path to an accepted trust anchor, this is a finding.

Vulnerability Number

V-222550

Documentable

False

Rule Version

APSC-DV-001810

Severity Override Guidance

Review the application documentation, the application architecture and interview the application administrator to identify the method employed by the application for validating certificates.

Review the method to determine if a certification path that includes status information is constructed when certificate validation occurs.

Some applications may utilize underlying OS certificate validation and certificate path building capabilities while others may build the capability into the application itself.

The certification path will include the intermediary certificate CAs along with a status of the CA server's signing certificate and will end at the trusted root anchor.

If the application does not construct a certificate path to an accepted trust anchor, this is a finding.

Check Content Reference

M

Target Key

4093

Comments