← Back to Omnissa Horizon Unified Access Gateway (UAG) Security Technical Implementation Guide

V-286600

CAT II (Medium)

The UAG must be configured with a DoW-issued TLS certificate.

Rule ID

SV-286600r1294292_rule

STIG

Omnissa Horizon Unified Access Gateway (UAG) Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

Machines on a DoW network must only accept Public Key Infrastructure (PKI) certificates obtained from a DoW-approved internal or external certificate authority (CA). If the CA used for verifying the certificate is not DoW-approved, trust of the CA will not be established. The UAG supports the replacement of the default, self-signed certificate with one issued by a DoW CA.

Check Content

Navigate to the UAG login page (user and/or admin page, depending on environment setup).

In the browser's URL address bar, find the certificate settings validating the site is secure and select to "View Certificate" (each browser is different).

In the "Certificate" dialog box, click the "Details" tab, then the "Issuer" field.

Validate the issuer is on the DoW-approved issuer list.

If the UAG does not use certificates that have been issued by a DoW-approved Certificate Authority (CA), this is a finding.

Fix Text

Log in to the UAG administrative interface as an administrator.

Select "Configure Manually".

Navigate to Advanced Settings >> TLS Server Certificate Settings.

Select the certificate type and network interfaces to apply the certificate to, then upload valid DoW-issued certificate files into the required fields.

Click "Save".

Note: If configuring UAG Commercial Solutions for Classified (CSfC) Compliant mode, ensure the certificates are issued with SHA-384 or greater signature.