TMA-SOPHOS-1.1.4
Ensure SSL server certificate for remote SSL VPN is configured correctly
Description
The Certificate used to secure SSL VPN should satisfy the following criteria. It should be a valid certificate from a trusted source. In most cases this means a trusted Public Certificate Authority as remote sslvpn users may not have access to any Private Certificate Authorities for Certificate validation. The certificate should have a valid date. It should not have a "to" date in the past (it should not be expired), and should not have a "from" date in the future. The key length used to encrypt the certificate should be 2048 bits or more. The hash used to sign the certificate should be SHA-2 or better. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Méthode de vérification
Méthode d'audit: Revue manuelle
Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.
Verify that the certificate being used to secure the SSL VPN meets the criteria listed. Navigate to 'System > Administration > Admin and User settings > Admin console and end-user interaction > Certificate' Ensure that a valid certificate is applied to the User portal. Navigate to 'Configure > Remote Access VPN > SSL VPN > SSL VPN global settings > SSL server certificate'. Ensure that a valid certificate is used for the SSL VPN Gateway.
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
Create a CSR and install a certificate from a public CA. Navigate to 'System > Administration > Admin and User settings > Admin console and end-user interaction > Certificate'. Set a valid certificate to the User portal. Navigate to 'Configure > Remote Access VPN > SSL VPN > SSL VPN global settings > SSL server certificate'. Set a valid certificate for the SSL VPN Gateway.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- sophoscrypto
- Référence
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.1.4 Ensure SSL server certificate for remote SSL VPN is configured correctly