The Samsung KNOX for Android platform must be configured to enable a Certificate Revocation Status (CRL) Check.

From Samsung Android OS 6 (with KNOX 2.x) Security Technical Implementation Guide

Associated with: CCI-000366

SV-84283r1_rule The Samsung KNOX for Android platform must be configured to enable a Certificate Revocation Status (CRL) Check.

Vulnerability discussion

A CRL allows a certificate issuer to revoke a certificate for any reason, including improperly issued certificates and compromise of the private keys. Checking the revocation status of the certificate mitigates the risk associated with using a compromised certificate.SFR ID: FMT_SMF_EXT.1.1 #45

Check content

This validation procedure is performed on the MDM Administration Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Enable Certificate Revocation Status (CRL) Check" settings in the "Android Restrictions" rule. 2. Verify the value is enabled and configured for all applications. If the setting is disabled, this is a finding.

Fix text

Configure the operating system to configure certification revocation status checking (CRL). On the MDM Administration Console, configure "Enable Certificate Revocation Status (CRL) Check" settings for all applications in the "Android Restrictions" rule.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.