Title

Software certificate installation files must be removed from Windows 2008. (Cat II impact)

Discussion

Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.

Check Content

Search all drives for *.p12 and *.pfx files. If any files with these extensions exist, this is a finding. This does not apply to server-based applications that have a requirement for certificate files. Some applications create files with extensions of .p12 that are not certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.

Fix Text

Remove any certificate installation files (*.p12 and *.pfx) found on a system. This does not apply to server-based applications that have a requirement for certificate files or non-certificate installation files with the same extension.

Additional Identifiers

Rule ID: SV-29465r2_rule

Vulnerability ID: V-15823

Group Title: Software Certificate Installation Files

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.