Ensure that strong algorithms are used for TLS certificates.

HighLevel 1Manual reviewwebsphere

Description

Certificates created with stronger algorithms use stronger hashes which is more secure. Also, some browsers warn when using weak certificates. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Ensure that Signature algorithm name is SHA256 or higher and Subject Public Key Algorithm is equal or higher than 2048 bit. keytool -list -v -keystore <keystore file name> -storepass <store password> - storetype <store type> | grep 'Signature algorithm name\|Subject Public Key Algorithm' ... Signature algorithm name: SHA256withRSA Subject Public Key Algorithm: 2048-bit RSA key ...

How it is fixed

Fix method: Guidance or infrastructure patch

Create certificates with SHA256 or higher algorithm and 2048 or higher key bit size.

Properties

Operating systems: Any
Tags: webspheremanual-review
Reference: CIS IBM WebSphere Liberty Benchmark v1.0.0 - 4.2.11 Ensure that strong algorithms are used for TLS certificates.