UCF STIG Viewer Logo

The Juniper SRX Services Gateway must use DoD-approved PKI rather than proprietary or self-signed device certificates.


Overview

Finding ID Version Rule ID IA Controls Severity
V-223207 JUSX-DM-000105 SV-223207r513310_rule Medium
Description
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs. The SRX generates a key-pair and a CSR. The CSR is sent to the approved CA, who signs it and returns it as a certificate. That certificate is then installed. The process to obtain a device PKI certificate requires the generation of a Certificate Signing Request (CSR), submission of the CSR to a CA, approval of the request by an RA, and retrieval of the issued certificate from the CA.
STIG Date
Juniper SRX SG NDM Security Technical Implementation Guide 2021-03-25

Details

Check Text ( C-24880r513308_chk )
To validate that the certificate was loaded, type the following command:

show security pki local-certificate

View the installed device certificates.

If any of the certificates have the name or identifier of a non-approved source in the Issuer field, this is a finding.
Fix Text (F-24868r513309_fix)
Generate a new key-pair from a DoD-approved certificate issuer. Sites must consult the PKI/PKI pages on the http://iase.disa.mil/ website for procedures for NIPRNet and SIPRNet.

RSA:
request security pki generate-key-pair certificate-id type rsa size <512 | 1024 | 2048 | 4096>

ECDSA:
request security pki generate-key-pair certificate-id type ecdsa size <256 | 384>

Generate a CSR from RSA key-pair using the following command and options.

request security generate-certificate-request certificate-id digest domain email ip-address subject “CN=,DC=,DC=,O=,OU=,
L=,ST=,C=” filename

Generate a CSR from ECDSA key-pair use the following command and options.

request security generate-certificate-request certificate-id digest domain email ip-address subject “CN=,DC=,DC=,O=,OU=,
L=,ST=,C=” filename

If no filename is specified, the CSR is displayed on the standard out (terminal)

After receiving the approved certificate from the CA, enter the following command and options to upload the certificate.

request security pki local-certificate certificate-id filename

From the operational mode of the hierarchy:

set security certificates local new load-key-file /var/tmp/new.pem

Type the following command to load the X.509 certificate into the certificate store in operations mode.

>request security pki local-certificate load certificate-id filename

For this example, assume the transferred the X.509 certificate called "device-cert.crt" to the /var/tmp directory on the SRXD. The following command will load the device-cert.crt certificate file and associate it with the public/private keypair named “device-keypair” generated in a previous step.

>request security pki local-certificate load certificate-id device-keypair filename /var/tmp/device-cert.crt