STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must be configured to use Online Certificate Status Protocol (OCSP) for certificate path validation and revocation. (OCSP is the preferred configuration.)

DISA Rule

SV-278406r1171970_rule

Vulnerability Number

V-278406

Group Title

SRG-APP-000605

Rule Version

NGNX-APP-002620

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.

Weight

10

Fix Recommendation

Edit the NGINX configuration file.

Set "ssl_verify_client on", "ssl_ocsp on", ssl_stapling_verify on", and "ssl_stapling on" as shown in the example below.

Create a local cache for OCSP responses:

touch /etc/nginx/ssl/ocsp_cache.pem
chmod 600 /etc/nginx/ssl/ocsp_cache.pem

Set the "ssl_stapling_file" directive with the file created as shown in the example below.

http {
server {
listen 443 ssl;
server_name example.com;

ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;

ssl_client_certificate /etc/nginx/ssl/ca.crt;

ssl_verify_client on;

ssl_crl /etc/nginx/ssl/crl.pem;

ssl_ocsp on;
ssl_ocsp_responder https://ocsp.disa.mil;

ssl_stapling on;
ssl_stapling_verify on;
ssl_stapling_file /etc/nginx/ssl/ocsp_cache.pem;
ssl_stapling_responder_timeout 3s; # Timeout for OCSP responder queries
ssl_stapling_responder_error_cache_time 300s; # Cache time for responder errors

location / {
proxy_pass http://backend;
}
}
}

Check Contents

If using CRL for certificate revocation, this requirement is Not Applicable.

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

# cat <path to config>

Check the http { blocks for the following example:

http {
server {
listen 443 ssl;
server_name example.com;

ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;

ssl_client_certificate /etc/nginx/ssl/ca.crt;

ssl_verify_client on;

ssl_crl /etc/nginx/ssl/crl.pem;

ssl_ocsp on;
ssl_ocsp_responder http://ocsp.disa.mil;

ssl_stapling on;
ssl_stapling_verify on;
ssl_stapling_file /etc/nginx/ssl/ocsp_cache.pem;
ssl_stapling_responder_timeout 3s; # Timeout for OCSP responder queries
ssl_stapling_responder_error_cache_time 300s; # Cache time for responder errors

location / {
proxy_pass http://backend;
}
}
}

Check for certificate path validation. If "ssl_verify_client on" is not in the configuration, this is a finding.

Check if OCSP is enabled. If "ssl_ocsp on" is not in the configuration, this is a finding.

Check if OCSP Stapling is configured. If "ssl_stapling on" or "ssl_stapling_verify on" is not in the configuration, this is a finding.

If "ssl_stapling_file <file>" is not present in the configuration, this is a finding.

Vulnerability Number

V-278406

Documentable

False

Rule Version

NGNX-APP-002620

Severity Override Guidance

If using CRL for certificate revocation, this requirement is Not Applicable.

Determine the path to NGINX config file(s):

# nginx -qT | grep "# configuration"
# configuration file /etc/nginx/nginx.conf:

Note: The default NGINX configuration is "/etc/nginx/nginx.conf", though various files may also be included.

# cat <path to config>

Check the http { blocks for the following example:

http {
server {
listen 443 ssl;
server_name example.com;

ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;

ssl_client_certificate /etc/nginx/ssl/ca.crt;

ssl_verify_client on;

ssl_crl /etc/nginx/ssl/crl.pem;

ssl_ocsp on;
ssl_ocsp_responder http://ocsp.disa.mil;

ssl_stapling on;
ssl_stapling_verify on;
ssl_stapling_file /etc/nginx/ssl/ocsp_cache.pem;
ssl_stapling_responder_timeout 3s; # Timeout for OCSP responder queries
ssl_stapling_responder_error_cache_time 300s; # Cache time for responder errors

location / {
proxy_pass http://backend;
}
}
}

Check for certificate path validation. If "ssl_verify_client on" is not in the configuration, this is a finding.

Check if OCSP is enabled. If "ssl_ocsp on" is not in the configuration, this is a finding.

Check if OCSP Stapling is configured. If "ssl_stapling on" or "ssl_stapling_verify on" is not in the configuration, this is a finding.

If "ssl_stapling_file <file>" is not present in the configuration, this is a finding.

Check Content Reference

M

Target Key

5720