STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must use TLS 1.2 or greater for secure communication.

DISA Rule

SV-257506r960759_rule

Vulnerability Number

V-257506

Group Title

SRG-APP-000014-CTR-000040

Rule Version

CNTR-OS-000020

Severity

CAT II

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

10

Fix Recommendation

Edit each resource and set the TLS Security Profile to Intermediate by executing the following:

oc edit ingresscontroller <NAME> -n <NAMESPACE>

Add the following to the file:

apiVersion: config.openshift.io/v1
kind: IngressController
...
spec:
tlsSecurityProfile:
intermediate: {}
type: Intermediate

Edit API Server by executing the following:

oc edit APIServer

Add the following to the file:

apiVersion: config.openshift.io/v1
kind: APIServer
...
spec:
tlsSecurityProfile:
intermediate: {}
type: Intermediate

Edit Kubelet by executing the following:

oc edit KubeletConfig <NAME>

Set to the following:

apiVersion: config.openshift.io/v1
kind: KubeletConfig
...
spec:
tlsSecurityProfile:
intermediate: {}
type: Intermediate

Check Contents

Verify the TLS Security Profile is not set to a profile that does not enforce TLS 1.2 or above.

View the TLS security profile for the ingress controllers by executing the following:

oc get --all-namespaces ingresscontrollers.operator.openshift.io -ocustom-columns="NAME":.metadata.name,"NAMESPACE":.metadata.namespace,"TLS PROFILE":.spec.tlsSecurityProfile

View the TLS security profile for the control plane by executing the following:

oc get APIServer cluster -ocustom-columns="TLS PROFILE":.spec.tlsSecurityProfile

View the TLS profile for the Kubelet by executing the following:

oc get kubeletconfigs -ocustom-columns="NAME":.metadata.name,"TLS PROFILE":.spec.tlsSecurityProfile

If any of the above returns a TLS profile of "Old", this is a finding.

If any of the above returns a TLS profile of "Custom" and the minTLSVersion is not set to "VersionTLS12" or greater, this is a finding.

If the above returns "<none>" TLS profile, this is not a finding as the TLS profile defaults to "Intermediate".

If the kubelet TLS profile check does not return any kubeletconfigs, this is not a finding as the default OCP installation uses defaults only.

Vulnerability Number

V-257506

Documentable

False

Rule Version

CNTR-OS-000020

Severity Override Guidance

Verify the TLS Security Profile is not set to a profile that does not enforce TLS 1.2 or above.

View the TLS security profile for the ingress controllers by executing the following:

oc get --all-namespaces ingresscontrollers.operator.openshift.io -ocustom-columns="NAME":.metadata.name,"NAMESPACE":.metadata.namespace,"TLS PROFILE":.spec.tlsSecurityProfile

View the TLS security profile for the control plane by executing the following:

oc get APIServer cluster -ocustom-columns="TLS PROFILE":.spec.tlsSecurityProfile

View the TLS profile for the Kubelet by executing the following:

oc get kubeletconfigs -ocustom-columns="NAME":.metadata.name,"TLS PROFILE":.spec.tlsSecurityProfile

If any of the above returns a TLS profile of "Old", this is a finding.

If any of the above returns a TLS profile of "Custom" and the minTLSVersion is not set to "VersionTLS12" or greater, this is a finding.

If the above returns "<none>" TLS profile, this is not a finding as the TLS profile defaults to "Intermediate".

If the kubelet TLS profile check does not return any kubeletconfigs, this is not a finding as the default OCP installation uses defaults only.

Check Content Reference

M

Target Key

5547