STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

The WebSphere Liberty Server must use DoD-issued/signed certificates.

DISA Rule

SV-250338r961044_rule

Vulnerability Number

V-250338

Group Title

SRG-APP-000177-AS-000126

Rule Version

IBMW-LS-000500

Severity

CAT II

CCI(s)

• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

Do not use self-signed certificates in a production environment. Only import certificates signed by an authorized DoD CA or authorized for DoD use.

Obtain the signer certificate either as a Base 64-encoded ASCII file or as binary DER data.

Using the JDK’s ikeyman or keytool utility, open the default trusted keystore specified in the ${server.config.dir}/server.xml.

Click on signer certificates and import the file that contains the DoD signed certificate.

Check Contents

As a privileged user with access to the ${server.config.dir}/server.xml file; search for SSLDefault in order to identify the default SSL configuration.

grep -i ssldefault server.xml

Identify the default ssl configuration by examining the sslRef flag.

SAMPLE:
<sslDefault sslRef="DefaultTLSSettings" />

Review the default ssl configuration to identify the default truststore.

SAMPLE:
<ssl id="DefaultTLSSettings" keyStoreRef="defaultKeyStore" />
<keyStore id="LDAPTrustStore" location="${server.config.dir}/liberty.ks" type="JKS" password="xxxxxxx" />

Use the java keytool or ikeyman utilities to open and examine the certificates stored in the truststore.

If the certificates are self signed or not signed by a DoD approved CA, this is a finding.

Vulnerability Number

V-250338

Documentable

False

Rule Version

IBMW-LS-000500

Severity Override Guidance

As a privileged user with access to the ${server.config.dir}/server.xml file; search for SSLDefault in order to identify the default SSL configuration.

grep -i ssldefault server.xml

Identify the default ssl configuration by examining the sslRef flag.

SAMPLE:
<sslDefault sslRef="DefaultTLSSettings" />

Review the default ssl configuration to identify the default truststore.

SAMPLE:
<ssl id="DefaultTLSSettings" keyStoreRef="defaultKeyStore" />
<keyStore id="LDAPTrustStore" location="${server.config.dir}/liberty.ks" type="JKS" password="xxxxxxx" />

Use the java keytool or ikeyman utilities to open and examine the certificates stored in the truststore.

If the certificates are self signed or not signed by a DoD approved CA, this is a finding.

Check Content Reference

M

Target Key

5424