STIGQter: STIG Summary: NetApp ONTAP DSC 9.x Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

ONTAP must use DoD-approved PKI rather than proprietary or self-signed device certificates.

DISA Rule

SV-246945r961863_rule

Vulnerability Number

V-246945

Group Title

SRG-APP-000516-NDM-000344

Rule Version

NAOT-CM-000008

Severity

CAT II

CCI(s)

• CCI-001159 - Issue public key certificates under an organization-defined certificate policy or obtain public key certificates from an approved service provider.

Weight

10

Fix Recommendation

Generate a new key-pair from a DOD-approved certificate issuer. Sites must consult the PKI/PKI pages on the https://cyber.mil website for procedures for NIPRNet and SIPRNet.

RSA:
request security pki generate-key-pair certificate-id <cert name> type rsa size <512 | 1024 | 2048 | 4096>

ECDSA:
request security pki generate-key-pair certificate-id <cert_name> type ecdsa size <256 | 384>

Generate a CSR from RSA key-pair using the following command and options.

request security generate-certificate-request certificate-id <cert_name_from_key_file> digest <sha1 | sha256> domain <FQDN> email <admin_email> ip-address <ip_address> subject “CN=<hostname>,DC=<domain_part>,DC=<TLD_domain>,O=<organization>,OU=<organization_dept>,
L=<city>,ST=<state>,C=<us>” filename <path/filename>

Generate a CSR from ECDSA key-pair using the following command and options.

request security generate-certificate-request certificate-id <cert_name_from_key_file> digest <sha256 | sha384> domain <FQDN> email <admin_email> ip-address <ip_address> subject “CN=<hostname>,DC=<domain_part>,DC=<TLD_domain>,O=<organization>,OU=<organization_dept>,
L=<city>,ST=<state>,C=<us>” filename <path/filename>

If no filename is specified, the CSR is displayed on the standard out (terminal).

After receiving the approved certificate from the CA, install the certificate with the command "security certificate install -type client-ca -vserver <vserver_name>".

For SSH accounts, apply the public key from the cert to the user account with the following command.

security login publickey create -vserver <vserver name> -username <username> -index 0 -publickey "ssh-rsa <cert_text>"

Check Contents

Use the command "security certificate show -instance -type client-ca" to show information about the ca-certificates that are installed.

If any of the certificates have the name or identifier of a nonapproved source in the Issuer field, this is a finding.

Vulnerability Number

V-246945

Documentable

False

Rule Version

NAOT-CM-000008

Severity Override Guidance

Use the command "security certificate show -instance -type client-ca" to show information about the ca-certificates that are installed.

If any of the certificates have the name or identifier of a nonapproved source in the Issuer field, this is a finding.

Check Content Reference

M

Target Key

5415