documentation_complete: true

prodtype: rhel7

title: 'Configure A Valid Server Certificate'

description: |-
    Configure the web site to use a valid organizationally defined certificate.
    For DoD, this is a DoD server certificate issued by the DoD CA.

rationale: |-
    This check verifies that DoD is a hosted web site's CA. The certificate is
    actually a DoD-issued server certificate used by the organization being
    reviewed. This is used to verify the authenticity of the web site to the user.
    If the certificate is not for the server (Certificate belongs to), if the
    certificate is not issued by DoD (Certificate was issued by), or if the current
    date is not included in the valid date (Certificate is valid from), then there
    is no assurance that the use of the certificate is valid. The entire purpose of
    using a certificate is, therefore, compromised.

severity: medium

identifiers:
    cce: "80559-8"

references:
    disa: ""
    nist: ""
    srg: ""
    stigid: WG350

ocil_clause: 'it is not'

ocil: |-
    Open browser window and browse to the appropriate site. Before entry to the
    site, you should be presented with the server's PKI credentials. Review
    these credentials for authenticity.
    <br /><br />
    For DoD, find an entry which cites:
    <pre>
    Issuer:
    CN =
    DOD CLASS 3 CA-3
    OU = PKI
    OU = DoD
    O = U.S. Government
    C = US
    </pre>
