BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

WN11-PK-000015 The DoW Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.

DISA STIG library V2R11
All changes in this version
first version loaded CAT II

Maps to SC-23(5) via CCI-002470

Title

The DoW Interoperability Root CA cross-certificates must be installed in the Untrusted Certificates Store on unclassified systems.

Control

Verify the DoW Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates. Run "PowerShell" as an administrator. Execute the following command: Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, NotAfter If valid DoW Interoperability cross-certificates (such as those below) are not displayed, this is a finding. Subject: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US NotAfter: 11/24/2030 Alternately, use the Certificates MMC snap-in: Run "MMC". Select "File", "Add/Remove Snap-in". Select "Certificates", click "Add". Select "Computer account", click "Next". Select "Local computer: (the computer this console is running on)", click "Finish". Click "OK". Expand "Certificates" and navigate to Untrusted Certificates >> Certificates. For each DoW Interoperability Root CA certificate displayed: Right-click on the certificate and select "Open". Select the "Details" tab. Verify the Expiration Date is a future date. Scroll to the bottom and select "Subject". If any of the certificates listed do not include "DoD Interoperability Root CA" in the name or are expired, this is a finding. Note: This should not be relied upon as a complete list of possible DoW Interoperability Root CA certificates. DoD Interoperability Root CA 2 Note: Interoperability cross certificates will have a different value (such as "...Root CA 6") in the 'Issued To' field than in the 'Subject' and 'Issuer' fields.

Discussion

To ensure users do not experience denial of service when performing certificate-based authentication to DoW websites due to the system chaining to a root other than DoW Root CAs, the DoW Interoperability Root CA cross-certificates must be installed in the Untrusted Certificate Store. This requirement only applies to unclassified systems.

Related controls

CCI-002470

Fix

Install valid (unexpired) DoW Interoperability Root CA cross-certificates on unclassified systems. The list below is not to be treated as exhaustive. The STIG should not be used as a definitive resource for the organizationally approved certificates for the systems. DoD Interoperability Root CA 2 The certificates can be installed using the InstallRoot tool. The tool and user guide are available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. Certificate bundles published by the PKI can be found at https://crl.gds.disa.mil/.