The Juniper SRX Services Gateway must use DoD-approved PKI rather than proprietary or self-signed device certificates.
From Juniper SRX SG NDM Security Technical Implementation Guide
Part of SRG-APP-000516-NDM-000344
Associated with:
CCI-000366
CCI-001159
SV-80983r1_rule
The Juniper SRX Services Gateway must use DoD-approved PKI rather than proprietary or self-signed device certificates.
Vulnerability discussion
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs.The SRX generates a key-pair and a CSR. The CSR is sent to the approved CA, who signs it and returns it as a certificate. That certificate is then installed. The process to obtain a device PKI certificate requires the generation of a Certificate Signing Request (CSR), submission of the CSR to a CA, approval of the request by an RA, and retrieval of the issued certificate from the CA.
Check content
To validate that the certificate was loaded, type the following command:
show security pki local-certificate
View the installed device certificates.
If any of the certificates have the name or identifier of a non-approved source in the Issuer field, this is a finding.
Fix text
Generate a new key-pair from a DoD-approved certificate issuer. Sites must consult the PKI/PKI pages on the http://iase.disa.mil/ website for procedures for NIPRNet and SIPRNet.
RSA:
request security pki generate-key-pair certificate-id type rsa size <512 | 1024 | 2048 | 4096>
ECDSA:
request security pki generate-key-pair certificate-id type ecdsa size <256 | 384>
Generate a CSR from RSA key-pair using the following command and options.
request security generate-certificate-request certificate-id digest domain email ip-address subject “CN=,DC=,DC=,O=,OU=,
L=,ST=,C=” filename
Generate a CSR from ECDSA key-pair use the following command and options.
request security generate-certificate-request certificate-id digest domain email ip-address subject “CN=,DC=,DC=,O=,OU=,
L=,ST=,C=” filename
If no filename is specified, the CSR is displayed on the standard out (terminal)
After receiving the approved certificate from the CA, enter the following command and options to upload the certificate.
request security pki local-certificate certificate-id filename
From the operational mode of the hierarchy:
set security certificates local new load-key-file /var/tmp/new.pem
Type the following command to load the X.509 certificate into the certificate store in operations mode.
>request security pki local-certificate load certificate-id filename
For this example, assume the transferred the X.509 certificate called "device-cert.crt" to the /var/tmp directory on the SRXD. The following command will load the device-cert.crt certificate file and associate it with the public/private keypair named “device-keypair” generated in a previous step.
>request security pki local-certificate load certificate-id device-keypair filename /var/tmp/device-cert.crt
Pro Tips
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer