Detections
Analytics

1.140 Ensure 'Specify if online OCSP/CRL checks are required for local trust anchors' is set to 'Enabled'

Information

This policy setting controls whether online certificate revocation checks (OCSP/CRL) are required and if a check online is not possible the certificate will be treated as though it is revoked.

The recommended state for this is: Enabled.

Certificates should always be validated, not doing so could potentially allow a revoked certificate to be used to give a false sense of a secure connection.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled :

Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Specify if online OCSP/CRL checks are required for local trust anchors

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft https://www.microsoft.com/en-us/edge/business/download.

Impact:

If Microsoft Edge cannot obtain a revocation status, the certificate will be treated as though it is revoked, therefore the website will not be loaded.

See Also

https://workbench.cisecurity.org/benchmarks/28120

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: Windows

Control ID: 4c9287283eb3b5f5a4811ee37978e725850730d85e9c1f0f2cff722a84f1b283