STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

DISA Rule

SV-274063r1120712_rule

Vulnerability Number

V-274063

Group Title

SRG-OS-000066-GPOS-00034

Rule Version

AZLX-23-001310

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-004909 - Include only approved trust anchors in trust stores or certificate stores managed by the organization.
• CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.
• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

Configure Amazon Linux 2023 to have valid certificates by using AWS Certificate Manager (ACM) or another certificate manager to manage SSL/TLS certificates.

In the AWS Management Console, request or import the necessary SSL/TLS certificates into ACM.

ACM will handle the certificate lifecycle management, including validation and trust chain establishment.

Check Contents

Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable.

Verify Amazon Linux 2023 for PKI-based authentication has valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Check that the system has a valid DOD root CA installed with the following command:

$ sudo openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Validity
Not Before: Mar 20 18:46:41 2012 GMT
Not After : Dec 30 18:46:41 2029 GMT
Subject: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption

If the root ca file is not a DOD-issued certificate with a valid date and installed in the /etc/sssd/pki/sssd_auth_ca_db.pem location, this is a finding.

Vulnerability Number

V-274063

Documentable

False

Rule Version

AZLX-23-001310

Severity Override Guidance

Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is not applicable.

Verify Amazon Linux 2023 for PKI-based authentication has valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Check that the system has a valid DOD root CA installed with the following command:

$ sudo openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Validity
Not Before: Mar 20 18:46:41 2012 GMT
Not After : Dec 30 18:46:41 2029 GMT
Subject: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption

If the root ca file is not a DOD-issued certificate with a valid date and installed in the /etc/sssd/pki/sssd_auth_ca_db.pem location, this is a finding.

Check Content Reference

M

Target Key

5700