OpenControls Logo

STIG Viewer

STIGViewer Support

The DOD Root CA certificates must be installed in the Trusted Root Store.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-253427WN11-PK-000005SV-253427r1210300_ruleCCI-000185medium
Description
To ensure secure DOD websites and DOD-signed code are properly validated, the system must trust the DOD Root Certificate Authorities (CAs). The DOD root certificates will ensure that the trust chain is established for server certificates issued from the DOD CAs.
STIGDate
Microsoft Windows 11 Security Technical Implementation Guide2026-05-19

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-10.2PKI-Based Authentication
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (53) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4(17)Domain Authentication
1.00

+43 more (top 10 by confidence shown)

CCI1 mapping
CCI-000185
1.00

Details

Check Text (C-253427r1210300_chk)

Verify the DOD Root CA certificates are installed as Trusted Root Certification Authorities. The certificates referenced below apply to unclassified systems; refer to PKE documentation for other networks. Run "PowerShell" as an administrator. Execute the following command: Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, NotAfter If valid DOD Root CA certificates (such as those below) are not displayed, this is a finding. Note: The Common Names (CN) below are examples. Very the "CN" displayed is a DOD Root CA and is not expired. Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US NotAfter: 12/30/2029 Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US NotAfter: 6/14/2041 Subject: CN=DoD Root CA 6 OU=PKI, OU=DoD, O=U.S. Government, C=US NotAfter: 1/24/2053 Alternately, use the Certificates MMC snap-in: Run "MMC". Select "File" and "Add/Remove Snap-in". Select "Certificates" and click "Add". Select "Computer account" and click "Next". Select "Local computer: (the computer this console is running on)" and click "Finish". Click "OK". Expand "Certificates" and navigate to Trusted Root Certification Authorities >> Certificates. For each of the DOD Root CA certificates noted below: Right-click on the certificate and select "Open". Select the "Details" tab. Verify the Expiration Date is a future date. Scroll to the bottom and select "Subject". If valid (unexpired) DOD Root CA certificates (such as those below) are not listed, this is a finding. DoD Root CA 3 / OU = PKI / OU = DoD / O = U.S. Government / C = U DoD Root CA 5 / OU = PKI / OU = DoD / O = U.S. Government / C = U DoD Root CA 6 / OU = PKI / OU = DoD / O = U.S. Government / C = U

Fix Text (F-56830r1210231_fix)

Install valid (unexpired) DOD Root CA certificates. The list below is not to be treated as exhaustive. They are valid as of this writing, but the STIG should not be used as a definitive resource for the organizationally approved DOD Root CA certificates for the systems. DoD Root CA 3 DoD Root CA 5 DoD Root CA 6 The InstallRoot tool is available on Cyber Exchange at https://cyber.mil/pki-pke/tools-configuration-files. PKI can be found at https://crl.gds.disa.mil/.