The Palo Alto Networks security platform must use DoD-approved PKI rather than proprietary or self-signed device certificates.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-228674 | PANW-NM-000141 | SV-228674r961863_rule | CCI-000366 | medium |
| Description | ||||
| DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling mandates that certificates must be issued by the DoD PKI or by a DoD-approved PKI for authentication, digital signature, or encryption. | ||||
| STIG | Date | |||
| Palo Alto Networks NDM Security Technical Implementation Guide | 2025-03-12 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · V3R3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · V3R3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · V3R3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · V3R3 · disa_xccdf · related
Details
Check Text (C-228674r961863_chk)
Go to Device >> Certificate Management >> Certificates
Installed Certificates are listed in the "Device Certificates" tab.
If any of the have the name or identifier of a non-approved source in the "Issuer" field, this is a finding.
Fix Text (F-30886r513626_fix)
Obtain a Device Certificate from the DoD PKI or from a DoD-approved PKI:
Go to Device >> Certificate Management >> Certificates
Select "Import" (at the bottom of the pane).
In the "Import Certificate" pane, complete each field.
Select "OK".