Rule ID
SV-286593r1294290_rule
Version
V1R1
CCIs
Non-DoW approved PKIs have not been evaluated to ensure that they have security controls and identity vetting procedures in place which are sufficient for DoW systems to rely on the identity asserted in the certificate. PKIs lacking sufficient security controls and identity vetting procedures risk being compromised and issuing certificates that enable adversaries to impersonate legitimate users.
Log in to the UAG administrative interface as an administrator. Select "Configure Manually". Navigate to General Settings >> Authentication Settings. Toggle the slider to show the settings. Click the gear icon next to "X.509 Certificate". Next to "Root and Intermediate CA Certificates", click "View". If any certificates in the list are issued by a non-DoW authority, this is a finding.
Log in to the UAG administrative interface as an administrator. Select "Configure Manually". Navigate to General Settings >> Authentication Settings. Toggle the slider to show the settings. Click the gear icon next to "X.509 Certificate". Next to "Root and Intermediate CA Certificates", click "View". Delete any certificates issued by a non-DoW authority. Click "Save".