STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must accept Personal Identity Verification (PIV) credentials.

DISA Rule

SV-278400r1172752_rule

Vulnerability Number

V-278400

Group Title

SRG-APP-000391

Rule Version

NGNX-APP-001650

Severity

CAT II

CCI(s)

• CCI-001953 - Accepts Personal Identity Verification-compliant credentials.
• CCI-001954 - Electronically verifies Personal Identity Verification-compliant credentials.
• CCI-002009 - Accept Personal Identity Verification-compliant credentials from other federal agencies.
• CCI-002010 - Electronically verify Personal Identity Verification-compliant credentials from other federal agencies.

Weight

10

Fix Recommendation

NGINX installs OpenSSL by default. If not installed, follow the OS documentation.

Include the following lines in the server {} block of nginx.conf:

ssl_certificate /etc/nginx/ssl/server_cert.pem;
ssl_certificate_key /etc/nginx/ssl/server_key.pem;
# Enable client certificate verification
ssl_client_certificate /etc/nginx/ca_cert.pem;
ssl_verify_client on;
# Optional: Set verification depth for client certificates
ssl_verify_depth 2;
location / {
proxy_pass http://backend_service;
# Restrict access to valid PIV credentials
if ($ssl_client_verify != SUCCESS) {
return 403;
}
}

Save and exit. Restart NGINX after modifying the configuration:

# nginx -s reload

Check Contents

Determine path to NGINX config file:

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Check that the nginx.conf file has the SSL Certificate/Key installed, the SSL Client Certificate is present, and SSL Verify is configured.

server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/nginx/ssl/server_cert.pem;
ssl_certificate_key /etc/nginx/ssl/server_key.pem;
# Enable client certificate verification
ssl_client_certificate /etc/nginx/ca_cert.pem;
ssl_verify_client on;
# Optional: Set verification depth for client certificates
ssl_verify_depth 2;
location / {
proxy_pass http://backend_service;
# Restrict access to valid PIV credentials
if ($ssl_client_verify != SUCCESS) {
return 403;
}
}
}

If the certificates are not configured and ssl_verify is not enabled, this is a finding.

Vulnerability Number

V-278400

Documentable

False

Rule Version

NGNX-APP-001650

Severity Override Guidance

Determine path to NGINX config file:

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Check that the nginx.conf file has the SSL Certificate/Key installed, the SSL Client Certificate is present, and SSL Verify is configured.

server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/nginx/ssl/server_cert.pem;
ssl_certificate_key /etc/nginx/ssl/server_key.pem;
# Enable client certificate verification
ssl_client_certificate /etc/nginx/ca_cert.pem;
ssl_verify_client on;
# Optional: Set verification depth for client certificates
ssl_verify_depth 2;
location / {
proxy_pass http://backend_service;
# Restrict access to valid PIV credentials
if ($ssl_client_verify != SUCCESS) {
return 403;
}
}
}

If the certificates are not configured and ssl_verify is not enabled, this is a finding.

Check Content Reference

M

Target Key

5720