BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

WN11-PK-000005 The DoW Root CA certificates must be installed in the Trusted Root Store.

DISA STIG library V2R11
All changes in this version
first version loaded CAT II

Maps to IA-5(2) via CCI-000185

Title

The DoW Root CA certificates must be installed in the Trusted Root Store.

Control

Verify the DoW Root CA certificates are installed as Trusted Root Certification Authorities. The certificates referenced below apply to unclassified systems; refer to PKE documentation for other networks. Run "PowerShell" as an administrator. Execute the following command: Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, NotAfter If valid DoW Root CA certificates (such as those below) are not displayed, this is a finding. Note: The Common Names (CN) below are examples. Verify the "CN" displayed is a DoW Root CA and is not expired. Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US NotAfter: 12/30/2029 Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US NotAfter: 6/14/2041 Subject: CN=DoD Root CA 6 OU=PKI, OU=DoD, O=U.S. Government, C=US NotAfter: 1/24/2053 Alternately, use the Certificates MMC snap-in: Run "MMC". Select "File" and "Add/Remove Snap-in". Select "Certificates" and click "Add". Select "Computer account" and click "Next". Select "Local computer: (the computer this console is running on)" and click "Finish". Click "OK". Expand "Certificates" and navigate to Trusted Root Certification Authorities >> Certificates. For each of the DoW Root CA certificates listed: Right-click on the certificate and select "Open". Select the "Details" tab. Verify the Expiration Date is a future date. Scroll to the bottom and select "Subject". If valid (unexpired) DoW Root CA certificates (such as those below) are not listed, this is a finding. DoD Root CA 3 DoD Root CA 5 DoD Root CA 6

Discussion

To ensure secure DoW websites and DoW-signed code are properly validated, the system must trust the DoW Root Certificate Authorities (CAs). The DoW root certificates will ensure that the trust chain is established for server certificates issued from the DoW CAs.

Related controls

CCI-000185

Fix

Install valid (unexpired) DoW Root CA certificates. The list below is not to be treated as exhaustive. The STIG should not be used as a definitive resource for the organizationally approved certificates for the systems. DoD Root CA 3 DoD Root CA 5 DoD Root CA 6 The InstallRoot tool is available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. Certificate bundles published by the PKI can be found at https://crl.gds.disa.mil/.