STIGQter STIGQter: STIG Summary: z/OS RACF STIG Version: 6 Release: 43 Benchmark Date: 24 Jan 2020: All digital certificates in use must have a valid path to a trusted Certification authority.

DISA Rule

SV-83837r1_rule

Vulnerability Number

V-69223

Group Title

ICER0010

Rule Version

ICERR010

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Remove or and replace certificates whose the issuer's distinguished name does not lead to a DoD PKI Root Certification Authority, External Root Certification Authority (ECA), or an approved External Partner PKI’s Root Certification Authority.

Check Contents

NOTE: The procedures in this checklist item presume the domain being reviewed is running all releases of z/OS, and use the ACP as the certificate store.
If the domain being review is not a production system and is only used for test and development, this Self-Signed Certificates review can be skipped.

Refer to the following report produced by the ACF2 Data Collection Checklist:

RACFCMDS.RPT(CERTRPT)

If no certificate information is found, there is NO FINDING.

NOTE: Certificates are only valid when their Status is TRUST. Therefore, you may ignore certificates with the NOTRUST status during the following checks.

If the digital certificate information indicates that the issuer's distinguished name leads to a DoD PKI Root Certification Authority, External Root Certification Authority (ECA), or an approved External Partner PKI’s Root Certification Authority, there is no finding. Reference the IASE website for complete information as to which certificates are acceptable (http://iase.disa.mil/pki-pke/interoperability/).

Examples of an acceptable DoD CA are:
DoD PKI Class 3 Root CA
DoD PKI Med Root CA

Vulnerability Number

V-69223

Documentable

False

Rule Version

ICERR010

Severity Override Guidance

NOTE: The procedures in this checklist item presume the domain being reviewed is running all releases of z/OS, and use the ACP as the certificate store.
If the domain being review is not a production system and is only used for test and development, this Self-Signed Certificates review can be skipped.

Refer to the following report produced by the ACF2 Data Collection Checklist:

RACFCMDS.RPT(CERTRPT)

If no certificate information is found, there is NO FINDING.

NOTE: Certificates are only valid when their Status is TRUST. Therefore, you may ignore certificates with the NOTRUST status during the following checks.

If the digital certificate information indicates that the issuer's distinguished name leads to a DoD PKI Root Certification Authority, External Root Certification Authority (ECA), or an approved External Partner PKI’s Root Certification Authority, there is no finding. Reference the IASE website for complete information as to which certificates are acceptable (http://iase.disa.mil/pki-pke/interoperability/).

Examples of an acceptable DoD CA are:
DoD PKI Class 3 Root CA
DoD PKI Med Root CA

Check Content Reference

M

Target Key

197

Comments