Detections
Analytics
WN25-PK-000010 - Windows Server 2025 must have the DoW Root Certificate Authority (CA) certificates installed in the Trusted Root Store.
Information
To ensure secure DoW websites and DoW-signed code are properly validated, the system must trust the DoW Root CAs. The DoW root certificates will ensure that the trust chain is established for server certificates issued from the DoW CAs.Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182, SRG-OS-000775-GPOS-00230
Solution
Install valid and unexpired DoW Root CA certificates.DOD Root CA 3
DOD Root CA 5
DOD Root CA 6
The InstallRoot tool is available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. Certificate bundles published by the PKI can be found at https://crl.gds.disa.mil/.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2025_V1R3_STIG.zip
Item Details
Audit Name: DISA Microsoft Windows Server 2025 STIG v1r3
Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|IA-5(2)(a), 800-53|SC-23(5), CAT|II, CCI|CCI-000185, CCI|CCI-002470, CCI|CCI-004909, Rule-ID|SV-278192r1256723_rule, STIG-ID|WN25-PK-000010, Vuln-ID|V-278192
Plugin: Windows
Control ID: 8af521687652dec4651bf2bf77f43aaa06c40da91359d8931bd9dd9e781fde4b