Exchange servers must use approved DoD certificates.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-228355	EX16-MB-000020	SV-228355r612748_rule		Medium

Description
Server certificates are required for many security features in Exchange; without them, the server cannot engage in many forms of secure communication. Failure to implement valid certificates makes it virtually impossible to secure Exchange's communications.

STIG	Date
Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide	2021-06-23

Details

Check Text ( C-30588r496861_chk )
Open the Exchange Management Shell and enter the following command: Get-ExchangeCertificate | Select CertificateDomains, issuer If the value of "CertificateDomains" does not indicate it is issued by the DoD, this is a finding.

Fix Text (F-30573r496862_fix)
Remove the non-DoD certificate and import the correct DoD certificates.