Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
FireFox is configured to ask which certificate to present to a web site when a certificate is required.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-15768 | DTBF050 | SV-16707r1_rule | ECSC-1 | Medium |
| Description |
|---|
| When a web site asks for a certificate for user authentication, Firefox must be configured to have the user choose which certificate to present. Websites within DOD require user authentication for access which increases security for DoD information. Access will be denied to the user if certificate management is not configured. |
| STIG | Date |
|---|---|
| Mozilla Firefox | 2015-03-26 |
Details
| Check Text ( C-16611r1_chk ) |
|---|
| Type "about:config" in the browser address bar. Verify Preference Name "security.default_personal_cert" is set to "Ask Every Time" and is locked to prevent the user from altering. Criteria: If the value of "security.default_personal_cert" is set incorrectly or is not locked, then this is a finding. |
| Fix Text (F-15985r1_fix) |
|---|
| Set the value of "security.default_personal_cert" to "Ask Every Time". Use the Mozilla.cfg file to lock the preference so users cannot change it. |