The DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate must be installed into the Untrusted Certificates Store.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32274	WN08-PK-000003	SV-48307r3_rule	IATS-1 IATS-2	Medium

Description
To ensure users do not experience denial of service on NIPRNet when performing certificate-based authentication to DoD websites due to the system chaining to a root other than DoD Root CA 2, the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate must be installed in the Untrusted Certificate Store. This requirement only applies to NIPRNet systems.

STIG	Date
Windows 8 / 8.1 Security Technical Implementation Guide	2015-03-09

Details

Check Text ( None )
None

Fix Text (F-48596r1_fix)
Install the DoD Interoperability Root CA 1 to DoD Root CA 2 cross certificate on NIPRNet systems only. Administrators should run the Federal Bridge Certification Authority (FBCA) Cross-Certificate Removal Tool once as an administrator and once as the current user. The FBCA Cross-Certificate Remover tool and user guide is available on IASE at http://iase.disa.mil/pki-pke/function_pages/tools.html.