Detections
Analytics
VCENTER-000017 - Revoked certificates must be removed from the vCenter Server
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
If revoked certificates are not removed from the vCenter Server, the user can be subject to a MiTM attack, which potentially might enable compromise through impersonation with the user's credentials to the vCenter Server system.Solution
If a site procedure to ensure the monitoring and removal of revoked certificates from the vCenter Server Windows host does not exist, create one. Check the vCenter Server/host for the presence of revoked certificates. Remove all revoked certificatesSee Also
http://iase.disa.mil/stigs/os/virtualization/Pages/index.aspx
Item Details
Audit Name: DISA STIG VMWare ESXi vCenter 5 STIG v1r7
References: CAT|II, CCI|CCI-000366, Group-ID|V-39555, Rule-ID|SV-51413r1_rule, STIG-ID|VCENTER-000017, Vuln-ID|V-39555
Plugin: VMware
Control ID: 2ceb5da33cf6ac6de8b9f3b37ceaee260fae435a42ced604f7920c23b7ac008f