OpenControls Logo

STIG Viewer

STIGViewer Support

The Sentry that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-251027MOIS-AL-000420SV-251027r1028193_ruleCCI-000185medium
Description
A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. Certification path validation includes checks such as certificate issuer trust, time validity and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.
STIGDate
Ivanti Sentry 9.x ALG Security Technical Implementation Guide2024-09-25

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-10.2PKI-Based Authentication
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (53) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4(17)Domain Authentication
1.00

+43 more (top 10 by confidence shown)

CCI1 mapping
CCI-000185
1.00

Details

Check Text (C-251027r1028193_chk)

The Sentry is configured with TLS by default. The Sentry enables TLS 1.2 by default. To check the status: 1. Log in to Sentry. 2. Go to Settings >> Services >> Sentry. 3. For each of the following configurations, follow step 4: a. Incoming SSL configuration b. Outgoing SSL configuration c. UEM SSL configuration d. Access SSL configuration 4. In Protocols, verify TLS 1.2 is enabled. If TLS 1.2 is not enabled for each configuration, this is a finding. For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes subsections on how TLS 1.2 is set as the default protocol: 1. Incoming SSL configuration 2. Outgoing SSL configuration 3. UEM SSL configuration 4. Access SSL configuration Sentry conforms to the NIST SP 800-52 TLS settings by setting TLS 1.2 by default.

Fix Text (F-54416r1004801_fix)

The Sentry is configured with TLS by default. To configure the Sentry with TLS 1.2: 1. Log in to Sentry. 2. Go to Settings >> Services >> Sentry. 3. Select each of the configurations listed below and follow steps 4 and 5: a. Incoming SSL configuration b. Outgoing SSL configuration c. UEM SSL Configuration d. Access SSL Configuration 4. In protocols, make TLS 1.2 enabled. 5. Apply the configuration and click "Save" in the top right corner.