Apache HTTP Server
TMA-APACHE-7.2
Ensure a Valid Trusted Certificate Is Installed
Description
The default SSL certificate is self-signed and is not trusted. Install a valid certificate signed by a commonly trusted certificate authority. To be valid, the certificate must be: Signed by a trusted certificate authority Not be expired, and Have a common name that matches the host name of the web server, such as www.example.com. Note ... Manual review: the benchmark gives no reliable automated check for this control.
Méthode de vérification
Méthode d'audit: Revue manuelle
Perform one or more of the following steps to determine if the recommended state is implemented: 1. The Qualys SSL Labs has a website that may be used for testing external servers. https://www.ssllabs.com/ssltest/ Enter the external host name of the server and wait for an extensive tests of TLS protocols and ciphers, in addition to testing the server certificate and the entire certificate authority chain. The SSL Labs test will report any weak digital signatures of the intermediate certificate authorities. For example, the report may include a warning of ...
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
Perform the following to implement the recommended state: 1. Decide on the host name to be used for the certificate. It is important to remember that the browser will compare the host name in the URL to the common name in the certificate, so that it is important that all https: URL's match the correct host name. Specifically, the host name www.example.com is not the same as example.com nor the same as ssl.example.com. 2. Generate a private key using openssl. Although certificate key lengths of 1024 have been common in the past, a key length of 2048 is now recommended for strong authentication. The key must be kept confidential and will be encrypted with a passphrase by default. Follow the steps below and respond to the prompts for a passphrase. See the Apache or OpenSSL documentation for details ...
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- apachetls
- Référence
- CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 7.2 Ensure a Valid Trusted Certificate Is Installed