STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must be configured to use a Certificate Revocation List (CRL) for certificate path validation and revocation. (Online Certificate Status Protocol [OCSP] is the preferred configuration.)

DISA Rule

SV-278391r1171925_rule

Vulnerability Number

V-278391

Group Title

SRG-APP-000175

Rule Version

NGNX-APP-000720

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.

Weight

10

Fix Recommendation

If using OCSP for certificate revocation, this requirement is Not Applicable.

Determine path to NGINX config file:

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

# cat <path to config>

Configure the following lines in the http { blocks using the example below.

Set ssl_verify_client on.
Set ssl_crl /etc/nginx/ssl/crl.pem to match the CRL file name.

http {
server {
listen 443 ssl;
server_name example.com;

ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;

ssl_client_certificate /etc/nginx/ssl/ca.crt;

ssl_verify_client on;

ssl_crl /etc/nginx/ssl/crl.pem;

ssl_ocsp on;
ssl_ocsp_responder http://ocsp.disa.mil;

ssl_stapling on;
ssl_stapling_verify on;
ssl_stapling_file /etc/nginx/ssl/ocsp_cache.pem;
ssl_stapling_responder_timeout 3s; # Timeout for OCSP responder queries
ssl_stapling_responder_error_cache_time 300s; # Cache time for responder errors

location / {
proxy_pass http://backend;
}
}
}

Check Contents

If using OCSP for certificate revocation, this requirement is Not Applicable.

Determine the path to NGINX config file:

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

# cat <path to config>

Check the http { blocks for the following example:

http {
server {
listen 443 ssl;
server_name example.com;

ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;

ssl_client_certificate /etc/nginx/ssl/ca.crt;

ssl_verify_client on;

ssl_crl /etc/nginx/ssl/crl.pem;

ssl_ocsp on;
ssl_ocsp_responder http://ocsp.disa.mil;

ssl_stapling on;
ssl_stapling_verify on;
ssl_stapling_file /etc/nginx/ssl/ocsp_cache.pem;
ssl_stapling_responder_timeout 3s; # Timeout for OCSP responder queries
ssl_stapling_responder_error_cache_time 300s; # Cache time for responder errors

location / {
proxy_pass http://backend;
}
}
}

Check for certificate path validation. If "ssl_verify_client on" is not present in the configuration, this is a finding.

Check if a CRL file is configured. If "ssl_crl <file>" is not present in the configuration, this is a finding.

Vulnerability Number

V-278391

Documentable

False

Rule Version

NGNX-APP-000720

Severity Override Guidance

If using OCSP for certificate revocation, this requirement is Not Applicable.

Determine the path to NGINX config file:

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

# cat <path to config>

Check the http { blocks for the following example:

http {
server {
listen 443 ssl;
server_name example.com;

ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;

ssl_client_certificate /etc/nginx/ssl/ca.crt;

ssl_verify_client on;

ssl_crl /etc/nginx/ssl/crl.pem;

ssl_ocsp on;
ssl_ocsp_responder http://ocsp.disa.mil;

ssl_stapling on;
ssl_stapling_verify on;
ssl_stapling_file /etc/nginx/ssl/ocsp_cache.pem;
ssl_stapling_responder_timeout 3s; # Timeout for OCSP responder queries
ssl_stapling_responder_error_cache_time 300s; # Cache time for responder errors

location / {
proxy_pass http://backend;
}
}
}

Check for certificate path validation. If "ssl_verify_client on" is not present in the configuration, this is a finding.

Check if a CRL file is configured. If "ssl_crl <file>" is not present in the configuration, this is a finding.

Check Content Reference

M

Target Key

5720