Detections
Analytics
WG350 IIS6 - A private web server must have a valid server certificate.
Information
This check verifies the server certificate is actually a DoD-issued certificate used by the organization being reviewed. This is used to verify the authenticity of the web site to the user. If the certificate is not issued by the DoD or if the certificate has expired, then there is no assurance that the use of the certificate is valid. The entire purpose of using a certificate is, therefore, compromised.NOTE: Nessus Plugin 'SSL Certificate Information' (ID 10863) will output the certificate information if the plugin is enabled in the policy.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Configure the private web site to use a valid DoD certificate.See Also
http://iasecontent.disa.mil/stigs/zip/July2015/U_IIS_6-0_V6R16_STIG.zip
Item Details
Audit Name: DISA STIG IIS 6.0 Site Checklist v6r16
References: CAT|II, Rule-ID|SV-38080r1_rule, STIG-ID|WG350_IIS6, Vuln-ID|V-2263
Plugin: Windows
Control ID: d9d19643fd1d0632b7e1d4a31f62a236cb5a6ebde7601e15f134ecaeba9a50c8