STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

For PKI-based authentication, ColdFusion must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.

DISA Rule

SV-279078r1172827_rule

Vulnerability Number

V-279078

Group Title

SRG-APP-000401-AS-000243

Rule Version

APAS-CF-000680

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure ColdFusion to use a locally cached CRL for certificate revocation checking.

1. Open the server.xml file located at: <ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml

2. Locate each <Connector> element configured for SSL.

3. Ensure an <SSLHostConfig> element is present and includes one of the following attributes:
certificateRevocationListFile="<path_to_crl_file>"
certificateRevocationListPath="<path_to_crl_directory>"

Example:
<SSLHostConfig>
<Certificate certificateKeystoreFile="..." type="RSA" />
<CertificateRevocation certificateRevocationListFile="/opt/cf/crl/mycrl.pem" />
</SSLHostConfig>

4. Save the file and restart ColdFusion to apply the changes.

Check Contents

Verify ColdFusion is configured to support certificate revocation checking using locally cached Certificate Revocation Lists (CRLs).

1. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml.

2. Open the server.xml file in a text editor.

3. Identify all <Connector> elements that are configured for SSL. Within each <Connector>, check for an embedded <SSLHostConfig> element.

4. Review the <SSLHostConfig> element for the presence of one of the following attributes:
certificateRevocationListFile
certificateRevocationListPath

(These attributes specify the location of locally cached CRL files that will be used for certificate revocation checking.)

If no <SSLHostConfig> is present, or if neither certificateRevocationListFile nor certificateRevocationListPath is configured, this is a finding.

Vulnerability Number

V-279078

Documentable

False

Rule Version

APAS-CF-000680

Severity Override Guidance

Verify ColdFusion is configured to support certificate revocation checking using locally cached Certificate Revocation Lists (CRLs).

1. For each ColdFusion instance, navigate to:
<ColdFusion_Installation_Directory>\cfusion\runtime\conf\server.xml.

2. Open the server.xml file in a text editor.

3. Identify all <Connector> elements that are configured for SSL. Within each <Connector>, check for an embedded <SSLHostConfig> element.

4. Review the <SSLHostConfig> element for the presence of one of the following attributes:
certificateRevocationListFile
certificateRevocationListPath

(These attributes specify the location of locally cached CRL files that will be used for certificate revocation checking.)

If no <SSLHostConfig> is present, or if neither certificateRevocationListFile nor certificateRevocationListPath is configured, this is a finding.

Check Content Reference

M

Target Key

5724