documentation_complete: true

title: 'Enable Online OCSP/CRL Certificate Checks'

description: |-
    Certificates can become compromised, and Chromium should check that the
    certificates in its store are valid by setting <tt>EnableOnlineRevocationChecks</tt>
    to <tt>true</tt> in the Chromium policy file.

rationale: |-
    Certificates are revoked when they have been compromised or are no longer valid,
    and this option protects users from submitting confidential data to a site that
    may be fraudulent or not secure.

severity: unknown

identifiers:
    cce: ""

references:
    disa: ""
    nist: ""
    stigid: DTBC0037

ocil_clause: 'it is not enabled'

ocil: |-
    To verify that online OCSP/CRL checks are enabled, run the following command:
    <pre>$ grep EnableOnlineRevocationChecks /etc/chromium/policies/managed/*.json</pre>
    The output should contain:
    <pre>"EnableOnlineRevocationChecks": true,</pre>
