Details

The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Follow the procedures below for each site hosted on the IIS 10.0 web server:

Open the IIS 10.0 Manager.

Click the Server name.

Double-click ‘Server Certificates’.

Click ‘Import’ under the ‘Actions’ pane.

Browse to the DoD certificate location, select it, and click ‘OK’.

Remove any non-DoD certificates if present.

Click on the site needing the certificate.

Select ‘Bindings’ under the ‘Actions’ pane.

Click on the binding needing a certificate and select ‘Edit’, or add a site binding for HTTPS.

Assign the certificate to the website by choosing it under the ‘SSL Certificate’ drop-down and clicking ‘OK’.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_IIS_10-0_Y20M10_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Windows.

References

• 800-53|SC-23(5)
• CAT|II
• CCI|CCI-002470
• Rule-ID|SV-218767r558649_rule
• STIG-ID|IIST-SI-000241
• STIG-Legacy|SV-109359
• STIG-Legacy|V-100255
• Vuln-ID|V-218767

Source

• Tenable.com/audits