TMA-MFD-7.1.1
Replace Self-Signed Certificates
Description
Print devices often utilize self-signed certificates to protect the communication between administrators and management interfaces. This is most commonly found when managing the device via an HTTPS interface. It is recommended that self-signed certificates be replaced by certificates that chain to a trusted certificate authority. Self-signed certificates are less effective at ensuring that the communication between the administrator and the management interface is not victim to a man in the middle attack. This is because the identity of the certificate holder is not attested to by a trusted third party. Given this, it is more feasible for a malicious entity to compromise administrative communication by generating his/her own self-signed certificate and presenting that certificate to the administrator’s HTTPS client on behalf of the MFD. 7.2 File Shares
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Verify compliance with CIS Multi-Function Device Benchmark v1.0.0 section 7.1.1: Replace Self-Signed Certificates.
How it is fixed
Fix method: Guidance or infrastructure patch
Follow the remediation procedure in CIS Multi-Function Device Benchmark v1.0.0 section 7.1.1 to configure: Replace Self-Signed Certificates.
Properties
- Operating systems
- Any
- Tags
- mfdprinter
- Reference
- CIS Multi-Function Device Benchmark v1.0.0 - 7.1.1 Replace Self-Signed Certificates