Riverbed Optimization System (RiOS) must obtain its public key certificates from an appropriate certificate policy through an approved service provider.

From Riverbed SteelHead CX v8 NDM Security Technical Implementation Guide

SV-77477r1_rule Riverbed Optimization System (RiOS) must obtain its public key certificates from an appropriate certificate policy through an approved service provider.

Vulnerability discussion

For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For federal agencies operating a legacy public key infrastructure cross-certified with the Federal Bridge Certification Authority at medium assurance or higher, this Certification Authority will suffice.

Check content

Verify that RiOS is configured to obtain its public key certificates from an appropriate certificate policy through an approved service provider. Navigate to the device Management Console Navigate to Configure >> Optimization >> Certificate Authorities Verify that DoD Root Certificates are listed on this page If no DoD Root CA Certificates are listed on this page, this is a finding.

Fix text

Configure RiOS to use public key certificates from an appropriate certificate policy through an approved service provider. Navigate to the device Management Console Navigate to Configure >> Optimization >> Certificate Authorities Click "Add a New Certificate Authority" Select "Local File" and "Browse" Navigate to your local DoD CA Root Certificates and select a certificate Click "Add" Repeat Click "Add a New Certificate Authority" down to Click "Add" for each DoD Root Certificate Navigate to the top of the web page and click "Save" to save these settings permanently

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.