Detections
Analytics
WN11-PK-000010 - The External Root CA certificates must be installed in the Trusted Root Store on unclassified systems.
Information
To ensure secure websites protected with External Certificate Authority (ECA) server certificates are properly validated, the system must trust the ECA Root CAs. The ECA root certificates will ensure the trust chain is established for server certificates issued from the External CAs. This requirement applies only to unclassified systems.Solution
Install valid (unexpired) ECA Root CA certificates on unclassified systems.The list below is not to be treated as exhaustive. The STIG should not be used as a definitive resource for the organizationally approved certificates for the systems.
ECA Root CA 4
ECA Root CA 5
The InstallRoot tool is available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. Certificate bundles published by the PKI can be found at https://crl.gds.disa.mil/.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V2R9_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows 11 STIG v2r9
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(2)(a), CAT|II, CCI|CCI-000185, Rule-ID|SV-253428r1256659_rule, STIG-ID|WN11-PK-000010, Vuln-ID|V-253428
Plugin: Windows
Control ID: 4339912bb036ca1ba445358316ebcfb9ac0376cf1546a9ee7ef0ec913862363a