STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must, for public key-based authentication, implement a local cache of revocation data to support path discovery and validation.

DISA Rule

SV-279409r1179526_rule

Vulnerability Number

V-279409

Group Title

SRG-APP-000875-DB-000280

Rule Version

MD8X-00-013800

Severity

CAT II

CCI(s)

• CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.

Weight

10

Fix Recommendation

Edit the MongoDB configuration file (default location /etc/mongod.conf) and add "setParameter" and its subkey "ocspEnabled" as shown below.

setParameter:
ocspEnabled: true

Refer to: https://www.mongodb.com/docs/v8.0/core/security-transport-encryption/#ocsp--online-certificate-status-protocol-

Check Contents

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "setParameter".

Examples shown below:

setParameter:
ocspEnabled: true

If this key "setParameter" and the subkey "ocspEnabled: true" are not found, this is a finding.

Vulnerability Number

V-279409

Documentable

False

Rule Version

MD8X-00-013800

Severity Override Guidance

Check the MongoDB configuration file (default location /etc/mongod.conf) for a key named "setParameter".

Examples shown below:

setParameter:
ocspEnabled: true

If this key "setParameter" and the subkey "ocspEnabled: true" are not found, this is a finding.

Check Content Reference

M

Target Key

5728