Detections
Analytics
WN11-PK-000005 - The DoW Root CA certificates must be installed in the Trusted Root Store.
Information
To ensure secure DoW websites and DoW-signed code are properly validated, the system must trust the DoW Root Certificate Authorities (CAs). The DoW root certificates will ensure that the trust chain is established for server certificates issued from the DoW CAs.Solution
Install valid (unexpired) DoW Root CA certificates.The list below is not to be treated as exhaustive. The STIG should not be used as a definitive resource for the organizationally approved certificates for the systems.
DoD Root CA 3
DoD Root CA 5
DoD Root CA 6
The InstallRoot tool is available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. Certificate bundles published by the PKI can be found at https://crl.gds.disa.mil/.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R9_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows 11 STIG v2r9
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(2)(a), CAT|II, CCI|CCI-000185, Rule-ID|SV-253427r1256656_rule, STIG-ID|WN11-PK-000005, Vuln-ID|V-253427
Plugin: Windows
Control ID: cc670b1c68f624027a849c20dfe13ef8132ab3c48441cf09a65c9276ad4e541d