STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Mar 2026:

TOSS 5 must include only approved trust anchors in trust stores or certificate stores managed by the organization.

DISA Rule

SV-282770r1201607_rule

Vulnerability Number

V-282770

Group Title

SRG-OS-000775-GPOS-00230

Rule Version

TOSS-05-000080

Severity

CAT II

CCI(s)

CCI-004909 - Include only approved trust anchors in trust stores or certificate stores managed by the organization.

Weight

Fix Recommendation

Configure TOSS 5 to include only approved trust anchors in trust stores or certificate stores by adding certificates using the following command:

$ sudo cp /path/to/new-ca-cert.pem /etc/pki/ca-trust/source/anchors/

$ sudo /bin/update-ca-trust

Check Contents

Verify TOSS 5 only uses trusted certificates using the following command:

$ sudo trust list --filter=blocklist

type: certificate
label: Explicitly Distrust DigiNotar Root CA
trust: distrusted
category: authority

If the "label" field is not configured with "Explicitly Distrust DigiNotar Root CA", if any other labels are present, the line is commented out, or the line is missing, this is a finding.

Vulnerability Number

V-282770

Documentable

False

Rule Version

TOSS-05-000080

Severity Override Guidance

Check Content Reference

Target Key

5738