STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.

DISA Rule

SV-253699r961038_rule

Vulnerability Number

V-253699

Group Title

SRG-APP-000175-DB-000067

Rule Version

MADB-10-004000

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

As the administrator locate the MariaDB configuration file to change. This varies depending on setup and how configuration files are managed but should be in /etc/my.cnf.d/. It is recommended to have a separate configuration file within this directory for SSL connection information.

In the [server] section add the lines for SSL:

ssl-ca=/path/to/ssl/ca-cert.pem
ssl-cert=/path/to/ssl/server-cert.pem
ssl-key=/path/to/ssl/server-key.pem

To fully implement SSL for MariaDB, the client settings and user accounts need to be set up as well. More information can be found here:
https://mariadb.com/kb/en/securing-connections-for-client-and-server/

Check Contents

As the database administrator, list all users and their SSL setup by running the following:

MariaDB> SELECT user, host, ssl_type FROM mysql.user;

Use the result of the next query to verify the MariaDB Server is using certificates:

MariaDB> STATUS;

Verify the line beginning with "SSL:" returns expected SSL information.

Using the following query, verify SSL is configured as expected:

MariaDB> SHOW GLOBAL VARIABLES LIKE %ssl% ;

If not configured as expected, this is a finding.

Vulnerability Number

V-253699

Documentable

False

Rule Version

MADB-10-004000

Severity Override Guidance

As the database administrator, list all users and their SSL setup by running the following:

MariaDB> SELECT user, host, ssl_type FROM mysql.user;

Use the result of the next query to verify the MariaDB Server is using certificates:

MariaDB> STATUS;

Verify the line beginning with "SSL:" returns expected SSL information.

Using the following query, verify SSL is configured as expected:

MariaDB> SHOW GLOBAL VARIABLES LIKE %ssl% ;

If not configured as expected, this is a finding.

Check Content Reference

M

Target Key

5475