← Back to IBM WebSphere Traditional V9.x Security Technical Implementation Guide

V-255877

CAT II (Medium)

The WebSphere Application Server must use DoD-approved Signer Certificates.

Rule ID

SV-255877r1137585_rule

STIG

IBM WebSphere Traditional V9.x Security Technical Implementation Guide

Version

V2R1

CCIs

CCI-002450

Discussion

Class 3 PKI certificates are used for servers and software signing rather than for identifying individuals. Class 4 certificates are used for business-to-business transactions. Utilizing unapproved certificates not issued or approved by DoD or CNS creates an integrity risk. The application server must utilize approved DoD or CNS Class 3 or Class 4 certificates for software signing and business-to-business transactions.

Check Content

From administrative console, navigate to Security >> SSL Certificates and Key Management >> KeyStores and Certificates.

For each keystore, click on "Signer Certificates".

If any of the certificates are not issued by an approved DoD CA, this is a finding.

Fix Text

Utilize DoD certificates that have been issued by a DoD PKI CA.

To replace a non-DoD PKI-established certificate:
From the administrative console, navigate to Security >> SSL Certificates and Key Management >> KeyStores and Certificates.

For each keystore that requires the change:
Import a new certificate by clicking "Import".

Click "keystore" file.

Enter the location of the new certificate.

Specify the type of keystore and keystore password.

Specify alias information.

Click "Apply". 

After the certificate is imported, click on "Replace" to replace the original certificate with the new certificate.