STIGQter: STIG Summary: HYCU Protege Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The HYCU virtual appliance must be configured to use DOD-approved online certificate status protocol (OCSP) responders or certificate revocation lists (CRLs) to validate certificates used for PKI-based authentication.

DISA Rule

SV-268235r1038742_rule

Vulnerability Number

V-268235

Group Title

SRG-APP-000175-NDM-000262

Rule Version

HYCU-ND-000180

Severity

CAT I

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

Weight

10

Fix Recommendation

OCSP revocation applies to all SSL communication done from HYCU Java application, including SMTP in SSL mode, LDAPS, and any HTTPS interaction (platform API servers, cloud targets, webhooks, etc.).

To enable OCSP revocation, log in to the HYCU console and edit the config file by executing the following command:
sudo vi /opt/grizzly/config.properties

and add the following line:
cert.path.revocation.checking.enabled=true

Check Contents

Log in to the HYCU console and execute the following command:
sudo cat /opt/grizzly/config.properties | grep
cert.path.revocation.checking.enabled=true

If the variable is not set to true, this is a finding.

Vulnerability Number

V-268235

Documentable

False

Rule Version

HYCU-ND-000180

Severity Override Guidance

Log in to the HYCU console and execute the following command:
sudo cat /opt/grizzly/config.properties | grep
cert.path.revocation.checking.enabled=true

If the variable is not set to true, this is a finding.

Check Content Reference

M

Target Key

5660