UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA).


Overview

Finding ID Version Rule ID IA Controls Severity
V-14820 DS00.2140_2003 SV-54947r1_rule IAKM-1 IAKM-2 IATS-1 IATS-2 High
Description
A PKI implementation depends on the practices established by the Certificate Authority (CA) to ensure the implementation is secure. Without proper practices, the certificates issued by a CA have limited value in authentication functions. The use of multiple CAs from separate PKI implementations results in interoperability issues. If servers and clients do not have a common set of root CA certificates, they are not able to authenticate each other.
STIG Date
Windows 2003 Domain Controller Security Technical Implementation Guide 2014-04-02

Details

Check Text ( C-48706r3_chk )
Verify the source of the domain controller's server certificate.

Run "mmc".
Select "Add/Remove Snap-in" from the File menu.
Click the "Add" button.
Select "Certificates" and click the "Add" button.
Select "Computer Account", click "Next".
Select the appropriate option for "Select the computer you want this snap-in to manage.", click "Finish".
Click "Close", then Click "OK".
Select and expand the Certificates (Local Computer) entry in the left pane.
Select and expand the Personal entry in the left pane.
Select the Certificates entry in the left pane.
In the right pane, examine the Issued By field for the certificate to determine the issuing CA.

If the Issued By field of the PKI certificate being used by the domain controller does not indicate the issuing Certificate Authority (CA) is part of the DoD PKI or an approved ECA, this is a finding.


There are multiple sources from which lists of valid DoD CAs and approved ECAs can be obtained:

The Global Directory Service (GDS) website provides an online source. The address for this site is https://crl.gds.disa.mil.

DoD Public Key Enablement (PKE) Engineering Support maintains the InstallRoot utility to manage DoD supported root certificates on Windows computers which includes a list of authorized CAs. The utility package can be downloaded from the PKI and PKE Tools page on IASE.
http://iase.disa.mil/pki-pke/function_pages/tools.html
Fix Text (F-47827r1_fix)
Obtain PKI certificates issued by the DoD PKI or an approved External Certificate Authority (ECA).