V-286223

Discussion

Only DoW-approved external PKIs have been evaluated to ensure that they have security controls and identity vetting procedures in place which are sufficient for DoW systems to rely on the identity asserted in the certificate. PKIs lacking sufficient security controls and identity vetting procedures risk being compromised and issuing certificates that enable adversaries to impersonate legitimate users. The authoritative list of DoW-approved PKIs is published at https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/pdf/unclass-ss_using_commercial_pki_certificates.pdf. This requirement focuses on communications protection for the MariaDB session rather than for the network packet.

Check Content

Verify whether MariaDB Enterprise Edition is in use.

Execute the following SQL query to review version information:

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM information_schema.GLOBAL_VARIABLES
WHERE VARIABLE_NAME IN ('version','version_comment','version_suffix');

In MariaDB Enterprise Edition, the version string typically contains the suffix "-enterprise". Enterprise deployments may also include additional enterprise-specific plugins or variables such as enterprise encryption or backup-related functionality. The version string is the definitive indicator of the edition in use.

After confirming the edition, verify that SSL certificate configuration is present in the MariaDB configuration.

Execute the following commands as a DBA to review the configured SSL certificate parameters:

SHOW GLOBAL VARIABLES LIKE 'ssl_ca';
SHOW GLOBAL VARIABLES LIKE 'ssl_cert';

The "Value" column returned by these commands displays the fully qualified file paths of the configured "ssl_ca" and "ssl_cert" files.

Use the following commands to identify the certificate issuer:

openssl x509 -in <fully-qualified-path-to-ssl_ca> -noout -issuer
openssl x509 -in <fully-qualified-path-to-ssl_cert> -noout -issuer

Verify that the certificate issuer corresponds to a DoW-approved PKI authority.

The authoritative list of DoW-approved PKI providers is published at https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/pdf/unclass-ss_using_commercial_pki_certificates.pdf.

If the database management system accepts end-entity certificates issued by non-DoW-approved PKI authorities, this is a finding.