UCF STIG Viewer Logo

FireFox is configured to ask which certificate to present to a web site when a certificate is required.


Overview

Finding ID Version Rule ID IA Controls Severity
V-15768 DTBF050 SV-16707r1_rule Medium
Description
When a web site asks for a certificate for user authentication, Firefox must be configured to have the user choose which certificate to present. Websites within DOD require user authentication for access which increases security for DoD information. Access will be denied to the user if certificate management is not configured.
STIG Date
Mozilla FireFox Security Technical Implementation Guide 2020-06-19

Details

Check Text ( C-16611r1_chk )
Type "about:config" in the browser address bar. Verify Preference Name "security.default_personal_cert" is set to "Ask Every Time" and is locked to prevent the user from altering.

Criteria: If the value of "security.default_personal_cert" is set incorrectly or is not locked, then this is a finding.
Fix Text (F-15985r1_fix)
Set the value of "security.default_personal_cert" to "Ask Every Time". Use the Mozilla.cfg file to lock the preference so users cannot change it.