Revoked certificates must be removed from the vCenter Server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39555	VCENTER-000017	SV-51413r1_rule		Medium

Description
If revoked certificates are not removed from the vCenter Server, the user can be subject to a MiTM attack, which potentially might enable compromise through impersonation with the user's credentials to the vCenter Server system.

STIG	Date
VMware vCenter Server Version 5 Security Technical Implementation Guide	2014-11-10

Details

Check Text ( C-46780r1_chk )
To check the status of SSL certificates on vCenter Server, open the vSphere Client and connect to the vCenter Server and log in. In the Security Warning dialog, click View Certificate and check the Valid from mm/dd/yy to mm/dd/yy field for the expiry information. Click OK. If unable to determine the certificate status from the certificate details, ask the SA if there is a site procedure to ensure the monitoring and removal of revoked certificates from the vCenter Server Windows host. Use this procedure to check the vCenter Server/host for the presence of revoked certificates. If a procedure does not exist and/or revoked certificates are found, this is a finding.

Check Text ( C-46780r1_chk )

To check the status of SSL certificates on vCenter Server, open the vSphere Client and connect to the vCenter Server and log in. In the Security Warning dialog, click View Certificate and check the Valid from mm/dd/yy to mm/dd/yy field for the expiry information. Click OK. If unable to determine the certificate status from the certificate details, ask the SA if there is a site procedure to ensure the monitoring and removal of revoked certificates from the vCenter Server Windows host. Use this procedure to check the vCenter Server/host for the presence of revoked certificates.

If a procedure does not exist and/or revoked certificates are found, this is a finding.

Fix Text (F-44568r1_fix)
If a site procedure to ensure the monitoring and removal of revoked certificates from the vCenter Server Windows host does not exist, create one. Check the vCenter Server/host for the presence of revoked certificates. Remove all revoked certificates.