STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

DISA Rule

SV-269412r1155277_rule

Vulnerability Number

V-269412

Group Title

SRG-OS-000384-GPOS-00167

Rule Version

ALMA-09-039070

Severity

CAT II

CCI(s)

• CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.
• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-004909 - Include only approved trust anchors in trust stores or certificate stores managed by the organization.
• CCI-004910 - Provide protected storage for cryptographic keys with organization-defined safeguards and/or hardware protected key store.

Weight

10

Fix Recommendation

Configure AlmaLinux OS 9, for PKI-based authentication, to validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Obtain a valid copy of the DOD root CA file from the PKI CA certificate bundle from cyber.mil and copy the DOD_PKE_CA_chain.pem into the /etc/sssd/pki/sssd_auth_ca_db.pem file (or pam_cert_db_path).

Check Contents

Verify AlmaLinux OS 9 for PKI-based authentication has valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

If "pam_cert_db_path" is set in "/etc/sssd/sssd.conf" or a "*.conf" file within the "/etc/sssd/conf.d/" directory, substitute that path for the default /etc/sssd/pki/sssd_auth_ca_db.pem used below.

Check that the system has a valid DOD root CA installed with the following command:

$ openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem

Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Validity
Not Before: Mar 20 18:46:41 2012 GMT
Not After: Dec 30 18:46:41 2029 GMT
Subject: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption

If the root CA file is not a DOD-issued certificate with a valid date and installed in "/etc/sssd/pki/sssd_auth_ca_db.pem" (or pam_cert_db_path location) this is a finding.

Vulnerability Number

V-269412

Documentable

False

Rule Version

ALMA-09-039070

Severity Override Guidance

Verify AlmaLinux OS 9 for PKI-based authentication has valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

If "pam_cert_db_path" is set in "/etc/sssd/sssd.conf" or a "*.conf" file within the "/etc/sssd/conf.d/" directory, substitute that path for the default /etc/sssd/pki/sssd_auth_ca_db.pem used below.

Check that the system has a valid DOD root CA installed with the following command:

$ openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem

Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Validity
Not Before: Mar 20 18:46:41 2012 GMT
Not After: Dec 30 18:46:41 2029 GMT
Subject: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption

If the root CA file is not a DOD-issued certificate with a valid date and installed in "/etc/sssd/pki/sssd_auth_ca_db.pem" (or pam_cert_db_path location) this is a finding.

Check Content Reference

M

Target Key

5664