OpenControls Logo

STIG Viewer

STIGViewer Support

The vCenter Server must enable revocation checking for certificate-based authentication.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258919VCSA-80-000080SV-258919r1015931_ruleCCI-000185medium
Description
The system must establish the validity of the user-supplied identity certificate using Online Certificate Status Protocol (OCSP) and/or Certificate Revocation List (CRL) revocation checking. Satisfies: SRG-APP-000175, SRG-APP-000392, SRG-APP-000401, SRG-APP-000403
STIGDate
VMware vSphere 8.0 vCenter Security Technical Implementation Guide2026-05-23

Related Frameworks

5 mappings across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-03.1Acceptance of PIV Credentials from Other Organizations
1.00
IAC-10.2PKI-Based Authentication
1.00
IAC-02.3Acceptance of PIV Credentials
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (75) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00

+65 more (top 10 by confidence shown)

CCI5 mappings
CCI-000185
1.00
CCI-001954
1.00
CCI-001991
1.00
CCI-002010
1.00
CCI-004068
1.00

Details

Check Text (C-258919r1015931_chk)

If a federated identity provider is configured and used for an identity source and supports smart card authentication, this is not applicable. From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider >> Smart Card Authentication. Under Smart Card Authentication settings >> Certificate Revocation, verify "Revocation check" does not show as disabled. If "Revocation check" shows as disabled, this is a finding.

Fix Text (F-62568r1003599_fix)

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider >> Smart Card Authentication. Under Smart Card Authentication settings >> Certificate Revocation, click the "Edit" button. Configure revocation checking per site requirements. OCSP with CRL failover is recommended. Note: If FIPS mode is enabled on vCenter, OCSP revocation validation may not function and CRL bay be used instead. By default, both locations are pulled from the cert. CRL location can be overridden in this screen, and local responders can be specified via the sso-config command line tool. Refer to the vSphere documentation for more information.