The SSMC web server must perform RFC 5280-compliant certification path validation.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-255259	SSMC-WS-010100	SV-255259r869946_rule		Medium

Description
A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. Certification path validation includes checks such as certificate issuer trust, time validity and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.

Description

A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. Certification path validation includes checks such as certificate issuer trust, time validity and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.

STIG	Date
HPE 3PAR SSMC Web Server Security Technical Implementation Guide	2022-10-13

Details

Check Text ( C-58872r869944_chk )
To verify SSMC always validates PKI certificates of all remote hosts that it connects to, in accordance with RFC 5280, do the following: 1. Log on to ssmc appliance as ssmcadmin and escape to general bash shell. 2. Execute the following command: $ grep ^ssmc.tls.trustmanager.enabled /opt/hpe/ssmc/ssmcbase/resources/ssmc.properties ssmc.tls.trustmanager.enabled=true If the command output does not show the property ssmc.tls.trustmanager.enabled as set to true, this is a finding.

Check Text ( C-58872r869944_chk )

To verify SSMC always validates PKI certificates of all remote hosts that it connects to, in accordance with RFC 5280, do the following:

1. Log on to ssmc appliance as ssmcadmin and escape to general bash shell.

2. Execute the following command:
$ grep ^ssmc.tls.trustmanager.enabled /opt/hpe/ssmc/ssmcbase/resources/ssmc.properties

ssmc.tls.trustmanager.enabled=true

If the command output does not show the property ssmc.tls.trustmanager.enabled as set to true, this is a finding.

Fix Text (F-58816r869945_fix)
Configure SSMC to always validate PKI certificates in accordance with RFC 5280 for all connections to remote hosts (as a client), by doing the following: 1. Log on to ssmc appliance as ssmcadmin and escape to general bash shell. 2. Edit (using vi editor) file /opt/hpe/ssmc/ssmcbase/resources/ssmc.properties and set the property ssmc.tls.trustmanager.enabled=true 3. Save the file and exit. 4. Type "config_appliance" to return to TUI. Restart (stop and start) SSMC services using TUI menu option 2.

Fix Text (F-58816r869945_fix)

Configure SSMC to always validate PKI certificates in accordance with RFC 5280 for all connections to remote hosts (as a client), by doing the following:

1. Log on to ssmc appliance as ssmcadmin and escape to general bash shell.

2. Edit (using vi editor) file /opt/hpe/ssmc/ssmcbase/resources/ssmc.properties and set the property ssmc.tls.trustmanager.enabled=true

3. Save the file and exit.

4. Type "config_appliance" to return to TUI. Restart (stop and start) SSMC services using TUI menu option 2.