V-286237

Discussion

Public key infrastructure (PKI) certificates are certificates with visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (i.e., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.

Check Content

Verify the certificate authority (CA) trust store configured for MariaDB. As the DBA, run:

SHOW GLOBAL VARIABLES LIKE 'ssl_ca';

If the "ssl_ca" variable is empty and TLS client certificate authentication is required, this is a finding.

Verify the CA file referenced by "ssl_ca" exists and is managed by the organization.

Example:
ls -l /etc/my.cnf.d/certs/ca-cert.pem

Confirm the file exists and is owned by the system administrator (SA) or DBA.

If the file does not exist or is not managed by the organization, this is a finding.

Review the contents of the CA trust store to verify only approved trust anchors are present.

Example:
openssl x509 -in /etc/my.cnf.d/certs/ca-cert.pem -text -noout

or, if multiple certificates exist:

grep "BEGIN CERTIFICATE" -n /etc/my.cnf.d/certs/ca-cert.pem

Verify the certificate authorities present match those approved by the organization.

If unapproved trust anchors are present, this is a finding.