← Back to IBM WebSphere Traditional V9.x Security Technical Implementation Guide

V-255877

CAT II (Medium)

The WebSphere Application Server must use DoW-approved Signer Certificates.

Rule ID

SV-255877r1265351_rule

STIG

IBM WebSphere Traditional V9.x Security Technical Implementation Guide

Version

V2R2

CCIs

CCI-002450

Discussion

Class 3 PKI certificates are used for servers and software signing rather than for identifying individuals. Class 4 certificates are used for business-to-business transactions. Utilizing unapproved certificates not issued or approved by DoW or CNS creates an integrity risk. The application server must utilize approved DoW or CNS Class 3 or Class 4 certificates for software signing and business-to-business transactions.

Check Content

From administrative console, navigate to Security >> SSL Certificates and Key Management >> KeyStores and Certificates.

For each keystore, click on "Signer Certificates".

If any of the certificates are not issued by an approved DoW CA, this is a finding.

Fix Text

Utilize DoW certificates that have been issued by a DoW PKI CA.

To replace a non-DoW PKI-established certificate:
From the administrative console, navigate to Security >> SSL Certificates and Key Management >> KeyStores and Certificates.

For each keystore that requires the change:
Import a new certificate by clicking "Import".

Click "keystore" file.

Enter the location of the new certificate.

Specify the type of keystore and keystore password.

Specify alias information.

Click "Apply". 

After the certificate is imported, click on "Replace" to replace the original certificate with the new certificate.