STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.

DISA Rule

SV-253738r1193220_rule

Vulnerability Number

V-253738

Group Title

SRG-APP-000427-DB-000385

Rule Version

MADB-10-008500

Severity

CAT II

CCI(s)

• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

Revoke trust in any certificates not issued by a DoD-approved certificate authority.

Configure MariaDB to accept only DoD and DoD-approved PKI end-entity certificates.

Check Contents

As the database administrator, check the following variables:

MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_ca';
MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_cert';

The Value column will show the fully qualified file name of the ssl_ca and ssl_cert respectively. The issuer can be found by running the following command:
$ openssl x509 -in fully-qualified-file-name-of-ssl_ca -noout -issuer
$ openssl x509 -in fully-qualified-file-name-of-ssl_cert -noout -issuer

The issuer should be checked against the authoritative list of DoD-approved PKIs, which is published at https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/pdf/unclass-ss_using_commercial_pki_certificates.pdf.

If the DBMS will accept non-DoD approved PKI end-entity certificates, this is a finding.

Vulnerability Number

V-253738

Documentable

False

Rule Version

MADB-10-008500

Severity Override Guidance

As the database administrator, check the following variables:

MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_ca';
MariaDB> SHOW GLOBAL VARIABLES LIKE 'ssl_cert';

The Value column will show the fully qualified file name of the ssl_ca and ssl_cert respectively. The issuer can be found by running the following command:
$ openssl x509 -in fully-qualified-file-name-of-ssl_ca -noout -issuer
$ openssl x509 -in fully-qualified-file-name-of-ssl_cert -noout -issuer

The issuer should be checked against the authoritative list of DoD-approved PKIs, which is published at https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/pdf/unclass-ss_using_commercial_pki_certificates.pdf.

If the DBMS will accept non-DoD approved PKI end-entity certificates, this is a finding.

Check Content Reference

M

Target Key

5475