STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX, when using PKI-based authentication, must enforce authorized access to the corresponding private key.

DISA Rule

SV-278392r1171928_rule

Vulnerability Number

V-278392

Group Title

SRG-APP-000176

Rule Version

NGNX-APP-000730

Severity

CAT II

CCI(s)

• CCI-000186 - For public key-based authentication, enforce authorized access to the corresponding private key.

Weight

10

Fix Recommendation

Change permissions on any TLS keys used in NGINX configuration:

nginx -qT | grep certificate_key
chmod 600 <path to TLS key>

Example:

root@e4a935153ece:/etc/ssl/nginx# nginx -qT | grep certificate_key
ssl_certificate_key /etc/ssl/nginx/server.key;
root@e4a935153ece:/etc/ssl/nginx# chmod 600 /etc/ssl/nginx/server.key

Restart NGINX:

nginx -s reload

Check Contents

Determine the path to NGINX config file:

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

cat <path to config>

Verify that private key(s) are only readable by the owner.

Example:

root@e4a935153ece:/etc/ssl/nginx# nginx -qT | grep certificate_key
ssl_certificate_key /etc/ssl/nginx/server.key;
root@e4a935153ece:/etc/ssl/nginx# ls -la /etc/ssl/nginx/server.key
-rw------- 1 root root 1704 Dec 4 18:31 /etc/ssl/nginx/server.key

If the private key(s) are readable anyone other than owner, this is a finding.

Vulnerability Number

V-278392

Documentable

False

Rule Version

NGNX-APP-000730

Severity Override Guidance

Determine the path to NGINX config file:

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

cat <path to config>

Verify that private key(s) are only readable by the owner.

Example:

root@e4a935153ece:/etc/ssl/nginx# nginx -qT | grep certificate_key
ssl_certificate_key /etc/ssl/nginx/server.key;
root@e4a935153ece:/etc/ssl/nginx# ls -la /etc/ssl/nginx/server.key
-rw------- 1 root root 1704 Dec 4 18:31 /etc/ssl/nginx/server.key

If the private key(s) are readable anyone other than owner, this is a finding.

Check Content Reference

M

Target Key

5720