Detections
Analytics

WINPK-000004 - The US DoD CCEB Interoperability Root CA cross-certificate must be installed.

Information

To ensure users do not experience denial of service when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CAs, the US DoD CCEB Interoperability Root CA cross-certificate must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.

 NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Install the US DoD CCEB Interoperability Root CA cross-certificate on unclassified systems.

Issued To - Issued By - Thumbprint
DoD Root CA 2 - US DoD CCEB Interoperability Root CA 1 - DA36FAF56B2F6FBA1604F5BE46D864C9FA013BA3

Administrators should run the Federal Bridge Certification Authority (FBCA) Cross-Certificate Removal Tool once as an administrator and once as the current user.

The FBCA Cross-Certificate Remover tool and user guide is available on IASE at http-//iase.disa.mil/pki-pke/Pages/tools.aspx.

See Also

http://iasecontent.disa.mil/stigs/zip/Oct2016/U_Windows_Vista_V6R41_STIG.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5(2)(a), 800-53|SC-23(5), CAT|II, CCI|CCI-000185, CCI|CCI-002470, Rule-ID|SV-52393r3_rule, STIG-ID|WINPK-000004, Vuln-ID|V-40237

Plugin: Windows

Control ID: 933d1b42e2b361b5fff27214583968a8aa82b5881535caa1fbb26aea904adb57