Title

All digital certificates in use must have a valid path to a trusted Certification authority. (Cat II impact)

Discussion

The origin of a certificate, the Certificate Authority (i.e., CA), is crucial in determining if the certificate should be trusted. An approved CA establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted.

Check Content

NOTE: The procedures in this checklist item presume the domain being reviewed is running all releases of z/OS, and use the ACP as the certificate store. If the domain being review is not a production system and is only used for test and development, this Self-Signed Certificates review can be skipped. Refer to the following report produced by the ACF2 Data Collection Checklist: RACFCMDS.RPT(CERTRPT) If no certificate information is found, there is NO FINDING. NOTE: Certificates are only valid when their Status is TRUST. Therefore, you may ignore certificates with the NOTRUST status during the following checks. If the digital certificate information indicates that the issuer's distinguished name leads to a DoD PKI Root Certification Authority, External Root Certification Authority (ECA), or an approved External Partner PKI’s Root Certification Authority, there is no finding. Reference the IASE website for complete information as to which certificates are acceptable (http://iase.disa.mil/pki-pke/interoperability/). Examples of an acceptable DoD CA are: DoD PKI Class 3 Root CA DoD PKI Med Root CA

Fix Text

Remove or and replace certificates whose the issuer's distinguished name does not lead to a DoD PKI Root Certification Authority, External Root Certification Authority (ECA), or an approved External Partner PKI’s Root Certification Authority.

Additional Identifiers

Rule ID: SV-83837r1_rule

Vulnerability ID: V-69223

Group Title: ICER0010

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.