STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must be configured to require SSL sessions to reauthenticate no longer than 15 minutes.

DISA Rule

SV-278399r1172775_rule

Vulnerability Number

V-278399

Group Title

SRG-APP-000389

Rule Version

NGNX-APP-001640

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Set the ssl_session_timeout directive to 15 or less.

Note: The default setting is five minutes and meets the control, but this STIG explicitly sets the variable to not rely on a default which may change in future versions.

Check Contents

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Examine the SSL configuration settings:

grep -R 'ssl_' /etc/nginx/nginx.conf

Verify that "ssl_session_timeout" is not set to greater than 15.

If "ssl_session_timeout" directive is missing or set to greater than 15, this is a finding.

Vulnerability Number

V-278399

Documentable

False

Rule Version

NGNX-APP-001640

Severity Override Guidance

Determine the path to NGINX config file(s):

nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Examine the SSL configuration settings:

grep -R 'ssl_' /etc/nginx/nginx.conf

Verify that "ssl_session_timeout" is not set to greater than 15.

If "ssl_session_timeout" directive is missing or set to greater than 15, this is a finding.

Check Content Reference

M

Target Key

5720