VCWN-65-000058 - The vCenter Server for Windows reverse proxy must use DoD approved certificates.

Information

The default self-signed, VMCA issued vCenter reverse proxy certificate must be replaced with a DoD approved certificate. The use of a DoD certificate on the vCenter reverse proxy assures clients that the service they are connecting to is legitimate and properly secured.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Obtain a DoD issued certificate and private key for each vCenter and external PSC in the system, following the below requirements:

Key size: 2048 bits or more (PEM encoded)
CRT format (Base-64)
x509 version 3
SubjectAltName must contain DNS Name=<machine_FQDN>
Contains the following Key Usages: Digital Signature, Non Repudiation, Key Encipherment

Verify that the issued certificate includes the full issuing chain. If it does not, concatenate the Base-64 intermediates and root onto the issued machine ssl cert.

Export the entire certificate issuing chain up to the root in Base-64 format, concatenate the individual certs into one file that will be used in the next steps when prompted for the signing certificate.

Run the certificate-manager tool:

Appliance:
/usr/lib/vmware-vmca/bin/certificate-manager

Windows:
C:\Program Files\VMware\vCenter Server\vmcad\certificate-manager.bat

Select option '1' to replace the machine ssl certificate. Select option '2' to specify existing certificate and private key. Supply the information as prompted remembering the signing certificate file built up previously.

Item Details

Audit Name: DISA VMware vSphere 6.5 vCenter Server for Windows STIG v2r3

Category: CONFIGURATION MANAGEMENT

Plugin: VMware

Control ID: 4fdb942d6b2fc9b90e2250dfd3f5f3aad3a0e45e5c5a1287394445dbef570a19

Detections

Analytics

VCWN-65-000058 - The vCenter Server for Windows reverse proxy must use DoD approved certificates.

Information

Solution

See Also

Item Details