Check: IISW-SV-000129
Microsoft IIS 8.5 Server STIG:
IISW-SV-000129
(in versions v2 r7 through v1 r7)
Title
The IIS 8.5 web server must perform RFC 5280-compliant certification path validation. (Cat II impact)
Discussion
This check verifies the server certificate is actually a DoD-issued certificate used by the organization being reviewed. This is used to verify the authenticity of the website to the user. If the certificate is not issued by the DoD or if the certificate has expired, then there is no assurance the use of the certificate is valid. The entire purpose of using a certificate is, therefore, compromised.
Check Content
Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "Server Certificate" icon. Double-click each certificate and verify the certificate path is to a DoD root CA. If the “Issued By” field of the PKI certificate being used by the IIS 8.5 server/site does not indicate the issuing Certificate Authority (CA) is part of the DoD PKI or an approved ECA, this is a finding.
Fix Text
Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Double-click the "Server Certificate" icon. Import a valid DoD certificate and remove any non-DoD certificates.
Additional Identifiers
Rule ID: SV-214415r879612_rule
Vulnerability ID: V-214415
Group Title: SRG-APP-000175-WSR-000095
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000185 |
The information system, for PKI-based authentication, validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information. |
Controls
| Number | Title |
|---|---|
| IA-5 (2) |
Pki-Based Authentication |