← Back to Jamf Pro v10.x EMM Security Technical Implementation Guide

V-241790

CAT II (Medium)

When the Jamf Pro EMM server cannot establish a connection to determine the validity of a certificate, the server must not have the option to accept the certificate.

Rule ID

SV-241790r961038_rule

STIG

Jamf Pro v10.x EMM Security Technical Implementation Guide

Version

V3R1

CCIs

CCI-000185 CCI-000366 CCI-001310 CCI-002450

Discussion

When a Jamf Pro EMM server accepts an unverified certificate, it may be trusting a malicious actor. For example, messages signed with an invalid certificate may contain links to malware, which could lead to the installation or distribution of that malware on DoD information systems, leading to compromise of DoD sensitive information and other attacks. SFR ID: FIA_X509_EXT.2.2

Check Content

Validate the Jamf Pro EMM server has been configured to not accept a certificate if the certificate cannot be validated.

1. Open the Jamf Pro EMM console.
2. Open "Settings".
3. Select "User-Initiated Enrollment".
4. Under the General tab, verify "Use a third-party signing certificate" is selected.
5. Verify the name and certificate extension of the DoD p12 certificate is listed.

If the Jamf Pro EMM server has been not been configured to not accept a certificate if the certificate cannot be validated, this is a finding.

Fix Text

Configure the Jamf Pro EMM server to not accept a certificate if the certificate cannot be validated.

1. Open the Jamf Pro EMM console.
2. Open "Settings".
3. Select "User-Initiated Enrollment".
4. Under the General tab, select "Use a third-party signing certificate".
5. Drag and drop the DoD p12 certificate.
6. Click "Save".