controls:
- id: SRG-APP-000605-CTR-001380
  levels:
  - medium
  title: {{{ full_name }}} must validate certificates used for Transport Layer
    Security (TLS) functions by performing an RFC 5280-compliant certification path
    validation.
  status: inherently met
  artifact_description: |-
    Supporting evidence is in the following documentation

    https://docs.openshift.com/container-platform/latest/security/certificate_types_descriptions/node-certificates.html
  status_justification: |+
    Internal components are secured with two-way TLS. Certificate revocation lists (CRLs) are not currently supported by Kubernetes upstream - https://github.com/kubernetes/kubernetes/issues/18982. Application components can be fully compliant by adding the checks inside container images.

    https://docs.openshift.com/container-platform/latest/security/certificate_types_descriptions/node-certificates.html

    Node certificates are signed by the cluster; they come from a certificate authority (CA) that is generated by the bootstrap process. Once the cluster is installed, the node certificates are auto-rotated.

    Node certificates are managed by the cluster and not the user

