The IIS 10.0 web server must perform RFC 5280-compliant certification path validation.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-100135	IIST-SV-000129	SV-109239r1_rule		Medium

Description
This check verifies the server certificate is actually a DoD-issued certificate used by the organization being reviewed. This is used to verify the authenticity of the website to the user. If the certificate is not issued by the DoD or if the certificate has expired, then there is no assurance the use of the certificate is valid, and therefore; the entire purpose of using a certificate is compromised.

Description

This check verifies the server certificate is actually a DoD-issued certificate used by the organization being reviewed. This is used to verify the authenticity of the website to the user. If the certificate is not issued by the DoD or if the certificate has expired, then there is no assurance the use of the certificate is valid, and therefore; the entire purpose of using a certificate is compromised.

STIG	Date
Microsoft IIS 10.0 Server Security Technical Implementation Guide	2020-06-08

Details

Check Text ( C-98987r1_chk )
Open the IIS 10.0 Manager. Click the IIS 10.0 web server name. Double-click the "Server Certificate" icon. Double-click each certificate and verify the certificate path is to a DoD root CA. If the “Issued By” field of the PKI certificate being used by the IIS 10.0 server/site does not indicate the issuing Certificate Authority (CA) is part of the DoD PKI or an approved ECA, this is a finding.

Check Text ( C-98987r1_chk )

Open the IIS 10.0 Manager.

Click the IIS 10.0 web server name.

Double-click the "Server Certificate" icon.

Double-click each certificate and verify the certificate path is to a DoD root CA.

If the “Issued By” field of the PKI certificate being used by the IIS 10.0 server/site does not indicate the issuing Certificate Authority (CA) is part of the DoD PKI or an approved ECA, this is a finding.

Fix Text (F-105821r1_fix)
Open the IIS 10.0 Manager. Click the IIS 10.0 web server name. Double-click the "Server Certificate" icon. Import a valid DoD certificate and remove any non-DoD certificates.