STIGQter: STIG Summary: Cisco ASA VPN Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

The Cisco ASA VPN remote access server must be configured to validate certificates used for Transport Layer Security (TLS) functions by performing RFC 5280-compliant certification path validation.

DISA Rule

SV-239984r666358_rule

Vulnerability Number

V-239984

Group Title

SRG-NET-000580-VPN-002410

Rule Version

CASA-VN-000730

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

Configure the ASA to validate certificates used for TLS functions by performing RFC 5280- compliant certification path validation as shown in the example below.

ASA2(config)# crypto ca trustpoint CA_X
ASA2(config-ca-trustpoint)# validation-usage ssl-client
ASA2(config-ca-trustpoint)# validation-usage ipsec-client

Check Contents

Verify the ASA validates TLS certificates by performing RFC 5280-compliant certification path validation.

Review the ASA configuration to determine if a CA trust point has been configured as shown in the example below.

crypto ca trustpoint CA_X
enrollment …
validation-usage ipsec-client
validation-usage ssl-client

If the ASA does not validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation, this is a finding.

Vulnerability Number

V-239984

Documentable

False

Rule Version

CASA-VN-000730

Severity Override Guidance

Verify the ASA validates TLS certificates by performing RFC 5280-compliant certification path validation.

Review the ASA configuration to determine if a CA trust point has been configured as shown in the example below.

crypto ca trustpoint CA_X
enrollment …
validation-usage ipsec-client
validation-usage ssl-client

If the ASA does not validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation, this is a finding.

Check Content Reference

M

Target Key

5344