STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Mar 2026:

TOSS 5, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

DISA Rule

SV-282442r1200306_rule

Vulnerability Number

V-282442

Group Title

SRG-OS-000066-GPOS-00034

Rule Version

TOSS-05-000366

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.

Weight

10

Fix Recommendation

If PKI-based authentication is used, configure TOSS 5 to validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Obtain a valid copy of the DOD root CA file from the PKI CA certificate bundle from cyber.mil and copy it into the following file:

/etc/sssd/pki/sssd_auth_ca_db.pem

Check Contents

If PKI-based authentication is used, verify TOSS 5 has valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Check that the system has a valid DOD root CA installed using the following command:

Note: If the system does not support PKI authentication, this requirement is not applicable.

$ sudo openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem

Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Validity
Not Before: Mar 20 18:46:41 2012 GMT
Not After : Dec 30 18:46:41 2029 GMT
Subject: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption

If the root CA file is not a DOD-issued certificate with a valid date and installed in the "/etc/sssd/pki/sssd_auth_ca_db.pem" location, this is a finding.

Vulnerability Number

V-282442

Documentable

False

Rule Version

TOSS-05-000366

Severity Override Guidance

If PKI-based authentication is used, verify TOSS 5 has valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Check that the system has a valid DOD root CA installed using the following command:

Note: If the system does not support PKI authentication, this requirement is not applicable.

$ sudo openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem

Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Validity
Not Before: Mar 20 18:46:41 2012 GMT
Not After : Dec 30 18:46:41 2029 GMT
Subject: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption

If the root CA file is not a DOD-issued certificate with a valid date and installed in the "/etc/sssd/pki/sssd_auth_ca_db.pem" location, this is a finding.

Check Content Reference

M

Target Key

5738