V-260578

Discussion

Without configuring a local cache of revocation data, there is the potential to allow access to users who are no longer authorized (users with revoked certificates).

Check Content

Verify Ubuntu 22.04 LTS, for PKI-based authentication, uses local revocation data when unable to access it from the network by using the following command: 
 
Note: If smart card authentication is not being used on the system, this is not applicable.  
  
     $ grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep  -E -- 'crl_auto|crl_offline' 
     cert_policy = ca,signature,ocsp_on,crl_auto; 
  
If "cert_policy" is not set to include "crl_auto" or "crl_offline", is commented out, or is missing, this is a finding.