← Back to IBM Hardware Management Console (HMC) Security Technical Implementation Guide

V-256885

CAT II (Medium)

A private web server must subscribe to certificates issued from any DoW-authorized Certificate Authority (CA) as an access control mechanism for web users.

Rule ID

SV-256885r1268345_rule

STIG

IBM Hardware Management Console (HMC) Security Technical Implementation Guide

Version

V2R2

CCIs

CCI-003992

Discussion

If the Hardware Management Consoles (HMC) is network connected, use SSL encryption techniques through digital certificates to provide message privacy, message integrity, and mutual authentication between clients and servers. To maintain data integrity, the IBM Certificate distributed with the HMC's is to be replaced by a DoW-authorized Certificate. Note: This check applies only to network-connected HMCs.

Check Content

The system reviewer will have the SA use the HMC Certificate Management Task to validate that the private key and certificate shipped with any network-connected HMC from IBM was replaced with an approved DoW-authorized Certificate.

Note: This check applies only to network-connected HMCs.

Note: DoW certificates should display the following Information: 'OU=PKI.OU=DoW.O=U.S. Government.C=US'

If private web server does not subscribe to certificates issued from any DoW-authorized CA as an access control mechanism for web users, this is a finding.

Fix Text

The SA must order a DoW PKI to replace the IBM Certificate and then use the Hardware Management Console Certificate Management Task to install it.

Note: This only applies to networked HMCs.