Software certificate installation files must be removed from a system.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
WN12-GE-000020	WN12-GE-000020	WN12-GE-000020_rule		Medium

Description
Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.

STIG	Date
Microsoft Windows Server 2012 Domain Controller Security Technical Implementation Guide	2013-07-25

Details

Check Text ( C-WN12-GE-000020_chk )
Search all drives for .p12 and .pfx files. If any files with these extensions exist, this is a finding. This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager). Some applications create files with extensions of .p12 that are NOT certificate installation files. Removal of noncertificate installation files from systems is not required. These must be documented with the IAO.

Check Text ( C-WN12-GE-000020_chk )

Search all drives for *.p12 and *.pfx files.

If any files with these extensions exist, this is a finding.

This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager). Some applications create files with extensions of .p12 that are NOT certificate installation files. Removal of noncertificate installation files from systems is not required. These must be documented with the IAO.

Fix Text (F-WN12-GE-000020_fix)
Remove any certificate installation files (.p12 and .pfx) found on a system. This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager).