STIGQter STIGQter: STIG Summary: VMware vSphere 8.0 ESXi Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The ESXi host must verify certificates for SSL syslog endpoints.

DISA Rule

SV-258779r1003572_rule

Vulnerability Number

V-258779

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-80-000224

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

To configure SSL syslog endpoint certificate checking, it must be turned on and the trusted certificate chain must be added to ESXi's trusted store.

From the vSphere Client go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Click "Edit". Select the "Syslog.global.certificate.checkSSLCerts" value and configure it to "true".

Copy the PEM formatted trusted CA certificate so that is accessible to the host and append the contents to /etc/vmware/ssl/castore.pem by running the following command:

# <path/to/cacert> >> /etc/vmware/ssl/castore.pem

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

Get-VMHost | Get-AdvancedSetting -Name Syslog.global.certificate.checkSSLCerts | Set-AdvancedSetting -Value "true"

Copy the PEM formatted trusted CA certificate so that is accessible to the host.

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.security.certificatestore.add.CreateArgs()
$arguments.filename = <path/to/cacert>
$esxcli.system.security.certificatestore.add.Invoke($arguments)

Check Contents

If SSL is not used for a syslog target, this is not applicable.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the "Syslog.global.certificate.checkSSLCerts" value and verify it is set to "true".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Syslog.global.certificate.checkSSLCerts

If the "Syslog.global.certificate.checkSSLCerts" setting is not set to "true", this is a finding.

Vulnerability Number

V-258779

Documentable

False

Rule Version

ESXI-80-000224

Severity Override Guidance

If SSL is not used for a syslog target, this is not applicable.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the "Syslog.global.certificate.checkSSLCerts" value and verify it is set to "true".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Syslog.global.certificate.checkSSLCerts

If the "Syslog.global.certificate.checkSSLCerts" setting is not set to "true", this is a finding.

Check Content Reference

M

Target Key

5562