documentation_complete: true

title: 'Configure DoD or CNS approved PKI Class 3 and Class 4 Certificates'

description: |-
    The server must use DoD or CNS approved PKI Class 3
    or Class 4 certificates.

rationale: |-
    Class 3 PKI certificates are used for servers and software signing
    rather than for identifying individuals. Class 4 certificates are used
    for business-to-business transactions. Utilizing unapproved certificates
    not issued or approved by DoD or CNS creates an integrity risk.

severity: high

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: ""

ocil_clause: 'DoD or CNS approved PKI Class 3 and Class 4 certificates are not configured or in use'
