A private web-site must utilize certificates from a trusted DoD CA.

Part of WG355

SV-32473r2_rule A private web-site must utilize certificates from a trusted DoD CA.

Vulnerability discussion

The use of a DoD PKI certificate ensures clients the private web site they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.

Check content

1. Open the IIS Manager. 2. Click the site name under review. 3. Click Bindings in the Action Pane. 4. Click the HTTPS type from the box. 5. Click Edit. 6. Click View, review and verify the certificate path. If the list of CAs in the trust hierarchy does not lead to the DoD PKI Root CA, DoD-approved external certificate authority (ECA), or DoD-approved external partner, this is a finding. If HTTPS is not an available type under site bindings, this is a finding.

Fix text

1. Open the IIS Manager. 2. Click the Server name. 3. Double-Click Server Certificates. 4. Click Import under the Actions Pane. 5. Browse to the DoD certificate location, select it, and click OK. 6. Remove any non-DoD certificates if present. 7. Click on the site needing the certificate. 8. Select Bindings under the Actions Pane. 9. Click on the binding needing a certificate and select edit, or add a site binding for HTTPS and execute step 10. 10. Assign the certificate to the web site by choosing it under the SSL Certificate drop down and clicking OK.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.