Vulnerability Discussion

To ensure users do not experience denial of service when performing certificate-based authentication to DoW websites due to the system chaining to a root other than DoW Root CAs, the DoW Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.

Satisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182

Check

This is applicable to unclassified systems. It is not applicable for others.

Open "PowerShell" as an administrator.

Execute the following command:

Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, NotAfter

If valid (and unexpired) DoW Interoperability cross-certificates (such as those below) are not listed, this is a finding.

Subject: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
NotAfter: 11/24/2030

Alternately, use the Certificates MMC snap-in:

Run "MMC".

Select "File", "Add/Remove Snap-in".

Select "Certificates" and click "Add".

Select "Computer account" and click "Next".

Select "Local computer: (the computer this console is running on)" and click "Finish".

Click "OK".

Expand "Certificates" and navigate to Untrusted Certificates >> Certificates.

For each DoW Interoperability Root CA certificate displayed:

Right-click on the certificate and select "Open".

Select the "Details" tab.

Verify that the Expiration Date is a future date.

Scroll to the bottom and select "Subject".

If any of the certificates listed do not include "DoD Interoperability Root CA" in the Subject (CN) name or are expired, this is a finding.

Note: The list below should not be relied upon as a complete set of possible DoW Interoperability Root CA cross-certificates.

DoD Interoperability Root CA 2

Note: Interoperability cross-certificates will have a different value (such as "...Root CA 6") in the 'Issued To' field than in the 'Subject' and 'Issuer' fields.

Fix

Install valid and unexpired DoW Interoperability Root CA cross-certificates on unclassified systems.

The list below is not to be treated as exhaustive. The STIG should not be used as a definitive resource for the organizationally approved certificates for the systems.

DoD Interoperability Root CA 2

Administrators must run the Federal Bridge Certification Authority (FBCA) Cross-Certificate Removal Tool once as an administrator and once as the current user.

The FBCA Cross-Certificate Remover Tool and User Guide are available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. Certificate bundles published by the PKI can be found at https://crl.gds.disa.mil/.