Title

The IE warning about certificate address mismatch must be enforced. (Cat II impact)

Discussion

This parameter warns users if the certificate being presented by the web site is invalid. Since server certificates are used to validate the identity of the web server it is critical to warn the user of a potential issue with the certificate being presented by the web server. This setting aids to prevent spoofing attacks.

Check Content

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page "Turn on Warn about Certificate Address Mismatch" must be "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: If the value WarnOnBadCertRecving is REG_DWORD = 1, this is not a finding.

Fix Text

Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page "Turn on Warn about Certificate Address Mismatch" to "Enabled".

Additional Identifiers

Rule ID: SV-43156r1_rule

Vulnerability ID: V-6239

Group Title: DTBI015-IE Warning of invalid certificates

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.