CCI|CCI-004068

Title

For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.

Reference Item Details

Reference: CCI - DISA Control Correlation Identifier

Category: 2024

Audit Items

View all Reference Audit Items

Name	Plugin	Audit Name
APPL-14-001060 - The macOS system must set smart card certificate trust to moderate.	Unix	DISA Apple macOS 14 (Sonoma) STIG v2r1
APPL-15-001060 - The macOS system must set smart card certificate trust to moderate.	Unix	DISA Apple macOS 15 (Sequoia) STIG v1r1
JUEX-NM-000640 - The Juniper EX switch must be configured to use an authentication server for the purpose of authenticating users prior to granting administrative access.	Juniper	DISA Juniper EX Series Network Device Management v2r1
JUSX-DM-000095 - The Juniper SRX Services Gateway must be configured to use an authentication server to centrally manage authentication and logon settings for remote and nonlocal access.	Juniper	DISA Juniper SRX Services Gateway NDM v3r1
JUSX-DM-000105 - The Juniper SRX Services Gateway must use DOD-approved PKI rather than proprietary or self-signed device certificates.	Juniper	DISA Juniper SRX Services Gateway NDM v3r1
OL08-00-010090 - OL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.	Unix	DISA Oracle Linux 8 STIG v2r1
PANW-NM-000110 - The Palo Alto Networks security platform must accept and verify Personal Identity Verification (PIV) credentials - 'Certificate Profile'	Palo_Alto	DISA STIG Palo Alto NDM v3r1
PANW-NM-000110 - The Palo Alto Networks security platform must accept and verify Personal Identity Verification (PIV) credentials - 'DOD CA certificates'	Palo_Alto	DISA STIG Palo Alto NDM v3r1
PANW-NM-000110 - The Palo Alto Networks security platform must accept and verify Personal Identity Verification (PIV) credentials - 'Use OCSP'	Palo_Alto	DISA STIG Palo Alto NDM v3r1
RHEL-09-631010 - RHEL 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.	Unix	DISA Red Hat Enterprise Linux 9 STIG v2r2
SLES-15-010170 - The SUSE operating system, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.	Unix	DISA SLES 15 STIG v2r1
UBTU-20-010066 - The Ubuntu operating system for PKI-based authentication, must implement a local cache of revocation data in case of the inability to access revocation information via the network.	Unix	DISA STIG Ubuntu 20.04 LTS v2r1
UBTU-22-612035 - Ubuntu 22.04 LTS for PKI-based authentication, must implement a local cache of revocation data in case of the inability to access revocation information via the network.	Unix	DISA STIG Canonical Ubuntu 22.04 LTS v2r2
VCSA-80-000080 The vCenter Server must enable revocation checking for certificate-based authentication.	VMware	DISA VMware vSphere 8.0 vCenter STIG v2r1