SV-83837r1_rule
V-69223
ICER0010
ICERR010
CAT II
10
Remove or and replace certificates whose the issuer's distinguished name does not lead to a DoD PKI Root Certification Authority, External Root Certification Authority (ECA), or an approved External Partner PKI’s Root Certification Authority.
NOTE: The procedures in this checklist item presume the domain being reviewed is running all releases of z/OS, and use the ACP as the certificate store.
If the domain being review is not a production system and is only used for test and development, this Self-Signed Certificates review can be skipped.
Refer to the following report produced by the ACF2 Data Collection Checklist:
RACFCMDS.RPT(CERTRPT)
If no certificate information is found, there is NO FINDING.
NOTE: Certificates are only valid when their Status is TRUST. Therefore, you may ignore certificates with the NOTRUST status during the following checks.
If the digital certificate information indicates that the issuer's distinguished name leads to a DoD PKI Root Certification Authority, External Root Certification Authority (ECA), or an approved External Partner PKI’s Root Certification Authority, there is no finding. Reference the IASE website for complete information as to which certificates are acceptable (http://iase.disa.mil/pki-pke/interoperability/).
Examples of an acceptable DoD CA are:
DoD PKI Class 3 Root CA
DoD PKI Med Root CA
V-69223
False
ICERR010
NOTE: The procedures in this checklist item presume the domain being reviewed is running all releases of z/OS, and use the ACP as the certificate store.
If the domain being review is not a production system and is only used for test and development, this Self-Signed Certificates review can be skipped.
Refer to the following report produced by the ACF2 Data Collection Checklist:
RACFCMDS.RPT(CERTRPT)
If no certificate information is found, there is NO FINDING.
NOTE: Certificates are only valid when their Status is TRUST. Therefore, you may ignore certificates with the NOTRUST status during the following checks.
If the digital certificate information indicates that the issuer's distinguished name leads to a DoD PKI Root Certification Authority, External Root Certification Authority (ECA), or an approved External Partner PKI’s Root Certification Authority, there is no finding. Reference the IASE website for complete information as to which certificates are acceptable (http://iase.disa.mil/pki-pke/interoperability/).
Examples of an acceptable DoD CA are:
DoD PKI Class 3 Root CA
DoD PKI Med Root CA
M
197