The Juniper SRX Services Gateway must use DOD-approved PKI rather than proprietary or self-signed device certificates.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223207	JUSX-DM-000105	SV-223207r997572_rule		Medium

Description
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs. The SRX generates a key-pair and a CSR. The CSR is sent to the approved Certification Authority (CA), who signs it and returns it as a certificate. That certificate is then installed. The process to obtain a device PKI certificate requires the generation of a Certificate Signing Request (CSR), submission of the CSR to a CA, approval of the request by an RA, and retrieval of the issued certificate from the CA.

Description

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs. The SRX generates a key-pair and a CSR. The CSR is sent to the approved Certification Authority (CA), who signs it and returns it as a certificate. That certificate is then installed. The process to obtain a device PKI certificate requires the generation of a Certificate Signing Request (CSR), submission of the CSR to a CA, approval of the request by an RA, and retrieval of the issued certificate from the CA.

STIG	Date
Juniper SRX SG NDM Security Technical Implementation Guide	2024-06-10

Details

Check Text ( C-24880r997570_chk )
To validate that the certificate was loaded, type the following command: show security pki local-certificate View the installed device certificates. If any of the certificates have the name or identifier of a nonapproved source in the Issuer field, this is a finding.

Fix Text (F-24868r997571_fix)
Generate a new key-pair from a DOD-approved certificate issuer. Sites must consult the PKI/PKI pages on the https://cyber.mil/ website for procedures for NIPRNet and SIPRNet. RSA: request security pki generate-key-pair certificate-id type rsa size <512 \| 1024 \| 2048 \| 4096> ECDSA: request security pki generate-key-pair certificate-id type ecdsa size <256 \| 384> Generate a CSR from RSA key-pair using the following command and options. request security generate-certificate-request certificate-id digest domain email ip-address subject “CN=,DC=,DC=,O=,OU=, L=,ST=,C=” filename Generate a CSR from ECDSA key-pair use the following command and options. request security generate-certificate-request certificate-id digest domain email ip-address subject “CN=,DC=,DC=,O=,OU=, L=,ST=,C=” filename If no filename is specified, the CSR is displayed on the standard out (terminal) After receiving the approved certificate from the CA, enter the following command and options to upload the certificate. request security pki local-certificate certificate-id filename From the operational mode of the hierarchy: set security certificates local new load-key-file /var/tmp/new.pem Type the following command to load the X.509 certificate into the certificate store in operations mode. >request security pki local-certificate load certificate-id filename For this example, assume the transferred the X.509 certificate called "device-cert.crt" to the /var/tmp directory on the SRXD. The following command will load the device-cert.crt certificate file and associate it with the public/private keypair named “device-keypair” generated in a previous step. >request security pki local-certificate load certificate-id device-keypair filename /var/tmp/device-cert.crt

Fix Text (F-24868r997571_fix)

Generate a new key-pair from a DOD-approved certificate issuer. Sites must consult the PKI/PKI pages on the https://cyber.mil/ website for procedures for NIPRNet and SIPRNet.

RSA:
request security pki generate-key-pair certificate-id type rsa size <512 | 1024 | 2048 | 4096>

ECDSA:
request security pki generate-key-pair certificate-id type ecdsa size <256 | 384>

Generate a CSR from RSA key-pair using the following command and options.

request security generate-certificate-request certificate-id digest domain email ip-address subject “CN=,DC=,DC=,O=,OU=,
L=,ST=,C=” filename

Generate a CSR from ECDSA key-pair use the following command and options.

request security generate-certificate-request certificate-id digest domain email ip-address subject “CN=,DC=,DC=,O=,OU=,
L=,ST=,C=” filename

If no filename is specified, the CSR is displayed on the standard out (terminal)

After receiving the approved certificate from the CA, enter the following command and options to upload the certificate.

request security pki local-certificate certificate-id filename

From the operational mode of the hierarchy:

set security certificates local new load-key-file /var/tmp/new.pem

Type the following command to load the X.509 certificate into the certificate store in operations mode.

>request security pki local-certificate load certificate-id filename

For this example, assume the transferred the X.509 certificate called "device-cert.crt" to the /var/tmp directory on the SRXD. The following command will load the device-cert.crt certificate file and associate it with the public/private keypair named “device-keypair” generated in a previous step.

>request security pki local-certificate load certificate-id device-keypair filename /var/tmp/device-cert.crt