STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must use DOD PKI-established certificate authorities for verification of the establishment of protected sessions.

DISA Rule

SV-260580r958868_rule

Vulnerability Number

V-260580

Group Title

SRG-OS-000403-GPOS-00182

Rule Version

UBTU-22-631010

Severity

CAT II

CCI(s)

• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

Configure Ubuntu 22.04 LTS to use of DOD PKI-established certificate authorities for verification of the establishment of protected sessions.

Add at least one DOD certificate authority to the "/usr/share/ca-certificates" directory in the CRT format.

Update the "/etc/ssl/certs" directory by using the following command:

$ sudo dpkg-reconfigure ca-certificates

Check Contents

Verify the directory containing the root certificates for Ubuntu 22.04 LTS contains certificate files for DOD PKI-established certificate authorities by iterating over all files in the "/etc/ssl/certs" directory and checking if, at least one, has the subject matching "DOD ROOT CA".

$ ls /etc/ssl/certs | grep -i DOD
DOD_PKE_CA_chain.pem

If no DOD root certificate is found, this is a finding.

Verify that all root certificates present on the system have been approved by the AO.

$ ls /etc/ssl/certs

If a certificate is present that is not approved by the AO, this is a finding.

Vulnerability Number

V-260580

Documentable

False

Rule Version

UBTU-22-631010

Severity Override Guidance

Verify the directory containing the root certificates for Ubuntu 22.04 LTS contains certificate files for DOD PKI-established certificate authorities by iterating over all files in the "/etc/ssl/certs" directory and checking if, at least one, has the subject matching "DOD ROOT CA".

$ ls /etc/ssl/certs | grep -i DOD
DOD_PKE_CA_chain.pem

If no DOD root certificate is found, this is a finding.

Verify that all root certificates present on the system have been approved by the AO.

$ ls /etc/ssl/certs

If a certificate is present that is not approved by the AO, this is a finding.

Check Content Reference

M

Target Key

5594