documentation_complete: true

title: 'Disable User Access to Online Certificate Validation Settings'

description: |-
    To ensure that users cannot change the online certificate verification settings,
    add <tt>deployment.security.validation.ocsp.locked</tt> to
    <tt>/etc/.java/deployment/deployment.properties</tt>.

rationale: |-
    Online certificate validation provides a greater degree of validation of certificates
    when running a signed Java applet. Permitting execution of an applet with an invalid
    certificate may result in malware execution , system modification, invasion of privacy,
    and denial of service. As such, ensuring users cannot change settings contributes to
    a more consistent security profile.

severity: medium

identifiers:
    cce: ""

references:
    disa: ""
    nist: DCBP-1
    stigid: JRE0050-UX

ocil_clause: 'it does not exist or is not configured properly'

ocil: |-
    To verify that users cannot change online certificate verification,
    run the following command:
    <pre>$ grep 'validation.ocsp.locked' /etc/.java/deployment/deployment.properties</pre>
    If properly configured, the output should return:
    <pre>deployment.security.validation.ocsp.locked</pre>
