STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

The WebSphere Liberty Server must be configured to use HTTPS only.

DISA Rule

SV-250348r1137581_rule

Vulnerability Number

V-250348

Group Title

SRG-APP-000440-AS-000167

Rule Version

IBMW-LS-001120

Severity

CAT II

CCI(s)

• CCI-002421 - Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.

Weight

10

Fix Recommendation

Modify the server.xml file. Enable the ssl-1.0 feature and configure the httpEndpoint settings. The keystores and truststores must also be configured.

<featureManager>
<feature>servlet-3.0</feature>
<feature>ssl-1.0</feature>
<feature>appSecurity-2.0</feature>
</featureManager>

<httpEndpoint id="defaultHttpEndpoint"
host="localhost"
httpPort="${bvt.prop.HTTP_default}"
httpsPort="${bvt.prop.HTTP_default.secure}" >
<tcpOptions soReuseAddr="true" />
<sslOptions sslRef="testSSLConfig" />
</httpEndpoint>

<ssl id="defaultSSLConfig"
keyStoreRef="defaultKeyStore"
trustStoreRef="defaultKeyStore"
serverKeyAlias="default" />

<ssl id="testSSLConfig"
keyStoreRef="defaultKeyStore"
trustStoreRef="alternateTrustStore"
serverKeyAlias="alternateCert"
enabledCiphers="AES256-SHA AES128-SHA" />

<!-- inbound (HTTPS) keystore -->
<keyStore id="defaultKeyStore" password="Liberty"
location="${server.config.dir}/resources/security/sslOptions.jks" />

<keyStore id="defaultTrustStore" password="Liberty"
location="${server.config.dir}/resources/security/trust.jks" />

<keyStore id="alternateTrustStore" password="Liberty"
location="${server.config.dir}/resources/security/optionsTrust.jks" />

<application type="war" id="basicauth" name="basicauth"
location="${server.config.dir}/apps/basicauth.war" />

Check Contents

Review the ${server.config.dir}/server.xml file and check the ssl-1.0 feature and httpEndpoint settings.

If the ssl-1.0 feature is not defined, this is a finding.

If the httpEndpoint settings do not include ssloptions, this is a finding.

<featureManager>
<feature>servlet-3.0</feature>
<feature>ssl-1.0</feature>
<feature>appSecurity-2.0</feature>
</featureManager>

<httpEndpoint id="defaultHttpEndpoint"
host="localhost"
httpPort="${bvt.prop.HTTP_default}"
httpsPort="${bvt.prop.HTTP_default.secure}" >
<tcpOptions soReuseAddr="true" />
<sslOptions sslRef="testSSLConfig" />
</httpEndpoint>

Vulnerability Number

V-250348

Documentable

False

Rule Version

IBMW-LS-001120

Severity Override Guidance

Review the ${server.config.dir}/server.xml file and check the ssl-1.0 feature and httpEndpoint settings.

If the ssl-1.0 feature is not defined, this is a finding.

If the httpEndpoint settings do not include ssloptions, this is a finding.

<featureManager>
<feature>servlet-3.0</feature>
<feature>ssl-1.0</feature>
<feature>appSecurity-2.0</feature>
</featureManager>

<httpEndpoint id="defaultHttpEndpoint"
host="localhost"
httpPort="${bvt.prop.HTTP_default}"
httpsPort="${bvt.prop.HTTP_default.secure}" >
<tcpOptions soReuseAddr="true" />
<sslOptions sslRef="testSSLConfig" />
</httpEndpoint>

Check Content Reference

M

Target Key

5424