V-286589

Discussion

A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. Certification path validation includes checks such as certificate issuer trust, time validity, and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses. The UAG provides an "Extended Server Certificate Validation" option that will verify information including hostname match, verification status, and validity period. Satisfies: SRG-NET-000164-ALG-000100, SRG-NET-000345-ALG-000099

Check Content

Log in to the UAG administrative interface as an administrator.

Select "Configure Manually".

Navigate to General Settings >> Authentication Settings. Toggle the slider to show the settings.

Click the gear icon next to "X.509 Certificate".

If "Enable Cert Revocation" is not toggled on, this is a finding.

Verify that at least one of the following options is enabled:

Option 1: Either the "Use CRL from Certificates" checkbox is enabled or the "CRL Location" text box contains a valid value.

Option 2: Verify the "Enable OCSP Revocation" checkbox is enabled, and either the "Use OCSP URL from certificate" checkbox is enabled or the "OCSP URL" text box contains a valid value.

If both options are enabled (CRL and OCSP), verify the "Use CRL in case of OCSP Failure" toggle is enabled.

If neither CRL nor OCSP certificate validation is enabled, this is a finding.