Detections
Analytics

1.210 WN22-PK-000030

Information

Windows Server 2022 must have the US DoW CCEB Interoperability Root CA cross-certificates in the Untrusted Certificates Store on unclassified systems.

GROUP ID: V-254444
RULE ID: SV-254444r1256704

To ensure users do not experience denial of service when performing certificate-based authentication to DoW websites due to the system chaining to a root other than DoW Root CAs, the US DoW CCEB Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.

Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182

Solution

Install valid and unexpired US DoW CCEB Interoperability Root CA cross-certificate on unclassified systems.

The list below is not to be treated as exhaustive. The STIG should not be used as a definitive resource for the organizationally approved certificates for the systems.

US DOD CCEB Interoperability Root CA 2

Administrators must run the Federal Bridge Certification Authority (FBCA) Cross-Certificate Removal Tool once as an administrator and once as the current user.

The FBCA Cross-Certificate Remover Tool and User Guide are available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. Certificate bundles published by the PKI can be found at https://crl.gds.disa.mil/.

See Also

https://workbench.cisecurity.org/benchmarks/28297

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5(2), 800-53|SC-23(5), CCI|CCI-000185, CCI|CCI-002470, Rule-ID|SV-254444r1256704_rule, STIG-ID|WN22-PK-000030, Vuln-ID|V-254444

Plugin: Windows

Control ID: 248091836536bfd7e9590f180c4c89d2e27b830467ad15f77c77305a31a9c116