Detections
Analytics

1.31 IIST-SI-000241

Information

The IIS 10.0 website must only accept client certificates issued by DOD PKI or DOD-approved PKI Certification Authorities (CAs).

GROUP ID: V-218767
RULE ID: SV-218767r1111811

The use of a DOD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DOD defense-in-depth strategy.

Solution

To add DOD Certificates to the Server, if not already present:

Open the IIS 10.0 Manager.

Click the Server name.

Double-click 'Server Certificates'.

Click 'Import' under the 'Actions' pane.

Browse to the DOD certificate location, select it, and click 'OK'.

Remove any non-DOD certificates if present.

Follow the procedures below for each site hosted on the IIS 10.0 web server to bind the certificates to the site:

Click on the site needing the certificate.

Select 'Bindings' under the 'Actions' pane.

Click on the binding needing a certificate and select 'Edit', or add a site binding for HTTPS.

Assign the certificate to the website by choosing it under the 'SSL Certificate' drop-down and clicking 'OK'.

See Also

https://workbench.cisecurity.org/benchmarks/23698

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-23(5), CAT|II, CCI|CCI-002470, Rule-ID|SV-218767r1111811_rule, STIG-ID|IIST-SI-000241, Vuln-ID|V-218767

Plugin: Windows

Control ID: c10207a7cffeb00ae1b32e62fd55e9c0585d3ea3963e2a21ecf2072887f1ff69