The BlackBerry Enterprise Mobility Server (BEMS) must be configured to use DoD certificates for SSL.

From BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide

Associated with: CCI-002470

SV-93731r1_rule The BlackBerry Enterprise Mobility Server (BEMS) must be configured to use DoD certificates for SSL.

Vulnerability discussion

Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established.

Check content

Verify a DoD SSL certificate has been installed on BEMS as follows: 1. Open the browser. 2. Browse to the BEMS dashboard. 3. Select SSL certificate and view the certificate. 4. Verify the certificate is a DoD certificate (has the DoD CA listed in the certificate). If the SSL certificate installed on BEMS is not a DoD certificate, this is a finding.

Fix text

Replace the auto-generated BEMS SSL certificate with a DoD certificate as follows: 1. Generate a CSR request and obtain a certificate from the DoD CA. 2. Import the certificate into the BEMS keystore. 3. Update the certificate passwords in BEMS.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.