IISW-SI-000241 - The IIS 8.5 private website have a server certificate issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs).

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Follow the procedures below for each site hosted on the IIS 8.5 web server:

Open the IIS 8.5 Manager.

Click the Server name.

Double-click 'Server Certificates'.

Click 'Import' under the 'Actions' pane.

Browse to the DoD certificate location, select it, and click 'OK'.

Remove any non-DoD certificates if present.

Click on the site needing the certificate.

Select 'Bindings' under the 'Actions' pane.

Click on the binding needing a certificate and select 'Edit', or add a site binding for HTTPS.

Assign the certificate to the website by choosing it under the 'SSL Certificate' drop-down and clicking 'OK'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_IIS_8-5_Y23M04_STIG.zip

Item Details

References: CAT|II, CCI|CCI-002470, Rule-ID|SV-214479r879798_rule, STIG-ID|IISW-SI-000241, STIG-Legacy|SV-91545, STIG-Legacy|V-76849, Vuln-ID|V-214479

Plugin: Windows

Control ID: b5049be657b21e8de8c12f41e382db26a879487b0b21e6783a9dc7ec104a83df