STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must only allow using DOD approved certificate authorities for PKI.

DISA Rule

SV-278403r1171961_rule

Vulnerability Number

V-278403

Group Title

SRG-APP-000427

Rule Version

NGNX-APP-001900

Severity

CAT II

CCI(s)

• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.
• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-004909 - Include only approved trust anchors in trust stores or certificate stores managed by the organization.

Weight

10

Fix Recommendation

Replace any non-DOD issued certificates with DOD-issued certificates.

After replacing the certificates, reload NGINX:

# nginx -s reload

Check Contents

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Find any "ssl_certificate" ssl_client_certificate" directives and verify they are DOD approved.

If the certificates are not DOD approved, this is a finding.

Vulnerability Number

V-278403

Documentable

False

Rule Version

NGNX-APP-001900

Severity Override Guidance

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

Find any "ssl_certificate" ssl_client_certificate" directives and verify they are DOD approved.

If the certificates are not DOD approved, this is a finding.

Check Content Reference

M

Target Key

5720