OpenControls Logo

STIG Viewer

STIGViewer Support

The ESXi host must use DOD-approved encryption to protect the confidentiality of network sessions.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-265974ESXI-80-000247SV-265974r1003578_ruleCCI-000068medium
Description
Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. In ESXi 8.0 Update 3 and newer TLS profiles are available to configure client and server TLS settings and must be configured to use only strong ciphers.
STIGDate
VMware vSphere 8.0 ESXi Security Technical Implementation Guide2026-06-04

Related Frameworks

3 mappings across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-14.2Protection of Confidentiality / Integrity Using Encryption
1.00
CRY-01Use of Cryptographic Controls
0.50
CRY-01.3Pre/Post Transmission Handling
0.50
DCH-10Media Use
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (46) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
AU-10(1)Association of Identities
1.00
AU-10(2)Validate Binding of Information Producer Identity
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-6Configuration Settings
1.00
CM-6(1)Automated Management, Application, and Verification
1.00
CM-7Least Functionality
1.00
CM-7(1)Periodic Review
1.00

+36 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.13
1.00
CCI3 mappings
CCI-000068
1.00
CCI-002420
1.00
CCI-002422
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-01
0.50
PR.DS-02
0.50
PR.DS-10
0.50

Details

Check Text (C-265974r1003578_chk)

From an ESXi shell, run the following command: # esxcli system tls server get --show-profile-defaults --show-current-boot-profile or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: $esxcli = Get-EsxCli -v2 $arguments = $esxcli.system.tls.server.get.CreateArgs() $arguments.showprofiledefaults = $true $arguments.showcurrentbootprofile = $true $esxcli.system.tls.server.get.invoke($arguments) Example result: Profile: NIST_2024 Cipher List: ECDHE+AESGCM Cipher Suite: TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384 Groups: prime256v1:secp384r1:secp521r1 Protocol Versions: tls1.2,tls1.3 Reboot Required: true If the TLS profile is not set to "NIST_2024" or is not the current boot profile, this is a finding.

Fix Text (F-69800r1003577_fix)

TLS Profiles can be configured with vSphere Configuration Profiles or manually on each host for clusters not using vSphere Configuration Profiles. For ESXi hosts in clusters managed with vSphere Configuration Profiles do the following: Note: These steps assume a vSphere Configuration Profile is already in use for the target cluster. From the vSphere Client, go to Host and Clusters. Select the vCenter Server >> Select the target cluster >> Configure >> Desired State >> Configuration >> Draft. Click "Create Draft" or "Import from Host" if a draft does not exist. Select system >> tls_server >> Configure Settings. Select "NIST_2024" from the drop down for profile and click "Save". Click "Apply Changes" and run through the pre-check to enforce the change. Note: Updating this setting through a vSphere Configuration Profile will place hosts into maintenance mode and perform a rolling reboot of all hosts in the cluster. For standalone hosts or clusters not managed with vSphere Configuration Profiles do the following: Prior to changing the TLS profile it is highly recommended to place the host in maintenance mode. From an ESXi shell, run the following command: # esxcli system tls server set -p NIST_2024 or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: $esxcli = Get-EsxCli -v2 $arguments = $esxcli.system.tls.server.set.CreateArgs() $arguments.profile = "NIST_2024" $esxcli.system.tls.server.set.invoke($arguments) A reboot is required to complete the process of changing profiles.