Detections
Analytics

VCWN-65-000060 - The vCenter Server for Windows must enable revocation checking for certificate based authentication.

Information

The system must establish the validity of the user supplied identity certificate using OCSP and/or CRL revocation checking.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

1. Login to the Platform Services Controller web interface with [email protected] from

https://<FQDN or IP of PSC>/psc

In an embedded deployment the Platform Services Controller host name or IP address is the same as the vCenter Server host name or IP address.

If you specified a different SSO domain during installation, log in as administrator@<mydomain>.

2. Browse to Single Sign-On > Configuration.

3. Click the 'Smart Card Configuration' tab

4. Click the 'Certificate Revocation Settings' tab

5. Click the 'Enable Revocation Check' button

By default the PSC will use the CRL from the certificate to check revocation check status. OCSP with CRL fallback is recommended but this setting is site specific and should be configured appropriately.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-5_Y23M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216879r879887_rule, STIG-ID|VCWN-65-000060, STIG-Legacy|SV-104653, STIG-Legacy|V-94823, Vuln-ID|V-216879

Plugin: VMware

Control ID: 713cc1a3403eddfc601dc4a25423496016aea5d805e780a5565485af0cf19076