documentation_complete: true

title: 'Enable Online Certificate Validation'

description: |-
    To ensure that online certificate verification is enabled, set
    <tt>deployment.security.validation.ocsp</tt> to equal <tt>true</tt>
    in <tt>/etc/.java/deployment/deployment.properties</tt>.

rationale: |-
    Online certificate validation provides a greater degree of validation of certificates
    when running a signed Java applet. Permitting execution of an applet with an invalid
    certificate may result in malware execution , system modification, invasion of privacy,
    and denial of service.

severity: medium

identifiers:
    cce: ""

references:
    disa: ""
    nist: DCBP-1
    stigid: JRE0040-UX

ocil_clause: 'it does not exist or is not configured properly'

ocil: |-
    To verify that online certificate verification is enabled,
    run the following command:
    <pre>$ grep 'validation.ocsp=true' /etc/.java/deployment/deployment.properties</pre>
    If properly configured, the output should return:
    <pre>deployment.security.validation.ocsp=true</pre>
