Ensure that the Certificate used for Decryption is Trusted

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Verify the CA Certificate(s): Navigate to Device > Certificate Management > Certificates Verify that appropriate internal certificates are imported, and that all certificates in the list are valid. In particular, verify the Subject, Issuer, CA, Expires, Algorithm and Usage fields Alternatively, if an internal CA is implemented on the firewall, verify that target clients have the root certificate for this CA imported into their list of trusted certificate authorities. (Full steps: CIS 8.3.)

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set the CA Certificate(s): Navigate to Device > Certificate Management > Certificates. Import the appropriate CA Certificates from any internal Certificate Authorities. Alternatively, generate a self-signed certificate for an internal CA on the firewall, and then import the root certificate for that CA into the trusted CA list of target clients. In an Active Directory environment this can be facilitated using a Group Policy. Set the Certificate Profile needed for the SSL Forward Proxy: Navigate to Device > Certificate Management > Certificate Profile. Set the decryption profile to include the settings described in the SSL Forward Proxy guidance in this document