Ensure valid certificate is set for web browser used to access Webadmin interface

MediumLevel 2Manual reviewsophos

Description

Default HTTPS port 4444 is used to access Sophos Firewall's Webadmin interface. HTTPS certificate used to secure the administrative session should satisfy the following criteria: 1. A valid certificate from a trusted source should be used. While a certificate from a trusted Public Certificate Authority is certainly valid, one from a trusted Private Certificate Authority is absolutely acceptable for this purpose. 2. The certificate should have a valid date. It should not have a "to" date in the past (it should not be expired), and should not have a "from" date in the future. 3. The certificate should use an acceptable cipher and encryption level. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Navigate to 'System > Certificates > Certificates'. Verify that the certificate used to secure HTTPS sessions meets the criteria by reviewing the appropriate certificate. Navigate to 'System > Administration > Admin settings > Admin console and end-user interaction > Certificate'. Verify that correct Certificate is used for Webadmin, user portal, captive portal and SPX reply portal.

How it is fixed

Fix method: Guidance or infrastructure patch

If a new administrative Certificate is needed, acquire a Certificate that meets the stated criteria and upload it to the Sophos Firewall. Optionally, download the appliance Certificate Authority to the web browser used for administration. Navigate to 'System > Certificates > Certificates > Add' Import an appropriate Certificate for your administrative session, from a trusted Certificate Authority. Navigate to 'System > Administration > Admin settings > Admin console and end-user interaction > Certificate' Choose the correct certificate to use for the web based administrative session.

Properties

Operating systems: Any
Tags: sophosauthentication
Reference: CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.1.7 Ensure valid certificate is set for web browser used to access Webadmin interface