Detections
Analytics
WN11-PK-000010 - The External Root CA certificates must be installed in the Trusted Root Store on unclassified systems.
Information
To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement applies only to unclassified systems.Solution
Install a valid (unexpired) ECA Root CA certificate on unclassified systems. The list below is not to be treated as exhaustive. They are valid as of this writing, but the STIG should not be used as a definitive resource for the organizationally approved ECA Root CA certificates for your systems.ECA Root CA 4
ECA Root CA 5
The InstallRoot tool is available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. PKI can be found at https://crl.gds.disa.mil/.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R8_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows 11 STIG v2r8
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(2)(a), CAT|II, CCI|CCI-000185, Rule-ID|SV-253428r1210301_rule, STIG-ID|WN11-PK-000010, Vuln-ID|V-253428
Plugin: Windows
Control ID: 282410b8ed6c602c201e18d26405ccf6e18e7cfe177e4fc94b6950454fe727c8