WBSP-AS-001370 - The WebSphere Application Server must use DoD-approved Signer Certificates.

Information

Class 3 PKI certificates are used for servers and software signing rather than for identifying individuals. Class 4 certificates are used for business-to-business transactions. Utilizing unapproved certificates not issued or approved by DoD or CNS creates an integrity risk. The application server must utilize approved DoD or CNS Class 3 or Class 4 certificates for software signing and business-to-business transactions.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Utilize DoD certificates that have been issued by a DoD PKI CA.

To replace a non-DoD PKI-established certificate:
From the administrative console, navigate to Security >> SSL Certificates and Key Management >> KeyStores and Certificates.

For each keystore that requires the change:
Import a new certificate by clicking 'Import'.

Click 'keystore' file.

Enter the location of the new certificate.

Specify the type of keystore and keystore password.

Specify alias information.

Click 'Apply'.

After the certificate is imported, click on 'Replace' to replace the original certificate with the new certificate.

See Also

http://iasecontent.disa.mil/stigs/zip/U_IBM_WebSphere_Traditional_V9-x_V1R1_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-13, CAT|II, CCI|CCI-002450, Rule-ID|SV-96083r1_rule, STIG-ID|WBSP-AS-001370, Vuln-ID|V-81369

Plugin: Unix

Control ID: 3ea7780240bfe28f0dfae022f04fae29e27dec64cb7a276c89ca23d741a7c17b