documentation_complete: true


title: 'Certificate status checking in SSSD'

description: |-
    Multifactor solutions that require devices separate from information systems gaining access include,
    for example, hardware tokens providing time-based or challenge-response authenticators and smart cards.
    Configuring <tt>certificate_verification</tt> to <tt>ocsp_dgst={{{ xccdf_value("var_sssd_certificate_verification_digest_function") }}}</tt> ensures that certificates for
    multifactor solutions are checked via Online Certificate Status Protocol (OCSP).

rationale: |-
    Ensuring that multifactor solutions certificates are checked via Online Certificate Status Protocol (OCSP)
    ensures the security of the system.

severity: medium

identifiers:
   cce@rhel8: CCE-86120-3
   cce@rhel9: CCE-87088-1
   cce@rhel10: CCE-86192-2

references:
    nist: IA-2(11)
    srg: SRG-OS-000375-GPOS-00160,SRG-OS-000377-GPOS-00162
    stigid@ol8: OL08-00-010400

ocil_clause: 'certificate_verification in sssd is not configured'

ocil: |-
    Check to see if Online Certificate Status Protocol (OCSP)
    is enabled and using the proper digest value on the system with the following command:
    <pre>$ sudo grep certificate_verification /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf | grep -v "^#"</pre>
    If configured properly, output should look like
    <pre>
        certificate_verification = ocsp_dgst={{{ xccdf_value("var_sssd_certificate_verification_digest_function") }}}
    </pre>

fixtext: |-
    Configure the operating system to implement certificate status checking for multifactor authentication.

    Review the "/etc/sssd/conf.d/certificate_verification.conf" file to determine if the system is configured to prevent OCSP or certificate verification.

    Add the following line to the "/etc/sssd/conf.d/certificate_verification.conf" file:

    certificate_verification = ocsp_dgst={{{ xccdf_value("var_sssd_certificate_verification_digest_function") }}}

    Set the correct ownership and permissions on the "/etc/sssd/conf.d/certificate_verification.conf" file by running these commands:

    $ sudo chown root:root "/etc/sssd/conf.d/certificate_verification.conf"
    $ sudo chmod 600 "/etc/sssd/conf.d/certificate_verification.conf"

    The "sssd" service must be restarted for the changes to take effect. To restart the "sssd" service, run the following command:

    $ sudo systemctl restart sssd.service

srg_requirement: '{{{ full_name }}} must implement certificate status checking for multifactor authentication.'
