documentation_complete: true


title: 'Certificate trust path in SSSD'

description: |-
    Enable certification trust path for SSSD to an accepted trust anchor.

rationale: |-
    Without path validation, an informed trust decision by the relying party cannot be made when 
    presented with any certificate not already explicitly trusted.

severity: medium


ocil_clause: 'certificate_verification in sssd is not configured'

ocil: |-
    Ensure "ca" is enabled in "certificate_verification" with the following command:
    <pre>$ sudo grep certificate_verification /etc/sssd/sssd.conf</pre>.
    If configured properly, output should look like
    <pre>
        certificate_verification = ca_cert,ocsp
    </pre>

fixtext: |-
    Configure SSSD for PKI-based authentication. To validate certificates by constructing a certification path
    to an accepted trust anchor by checking the following configuration of the <pre>/etc/sssd/sssd.conf</pre> file.
    <pre>
        [domain/example.com]
        ldap_user_certificate = usercertificate;binary
        certificate_verification = ca_cert,ocsp
        ca_cert = /etc/ssl/certs/ca-certificates.crt
    </pre>
