The Dell OS10 Switch must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-269802 | OS10-NDM-000960 | SV-269802r1052489_rule | CCI-000366 | medium |
| Description | ||||
| For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For federal agencies operating a legacy public key infrastructure cross-certified with the Federal Bridge Certification Authority at medium assurance or higher, this certification authority (CA) will suffice. Satisfies: SRG-APP-000516-NDM-000344, SRG-APP-000910-NDM-000300 | ||||
| STIG | Date | |||
| Dell OS10 Switch NDM Security Technical Implementation Guide | 2024-12-11 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · V1R1 · disa_xccdf · related
Details
Check Text (C-269802r1052489_chk)
Determine if the OS10 Switch obtains public key certificates from an appropriate certificate policy through an approved service provider.
Verify the configured CA certificates with the following commands:
OS10# show crypto ca-certs
--------------------------------------
| Locally installed certificates |
--------------------------------------
DOD_PKE.crt
OS10#
OS10# show crypto ca-certs DOD_PKE.crt
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
...
If the OS10 Switch does not obtain its public key certificates from an appropriate certificate policy through an approved service provider, this is a finding.
Fix Text (F-73736r1051790_fix)
Configure the OS10 Switch to obtain its public key certificates from an appropriate certificate policy through an approved service provider.
Install CA certificates using the crypto ca-cert install command as shown in the example below.
OS10# crypto ca-cert install
Certificate base file name : DOD_PKE
Paste certificate below.
Include the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- headers.
Enter a blank line to abort this command.
Certificate:
-----BEGIN CERTIFICATE-----
MIID...
...
...=
-----END CERTIFICATE-----
Install as trusted-host certificate? [yes/no]:n
Processing file ...
Installed Root CA certificate
CommonName = ...
IssuerName = ...
OS10#