TMA-SOPHOS-1.1.4
Ensure SSL server certificate for remote SSL VPN is configured correctly
Deskripsi
The Certificate used to secure SSL VPN should satisfy the following criteria. It should be a valid certificate from a trusted source. In most cases this means a trusted Public Certificate Authority as remote sslvpn users may not have access to any Private Certificate Authorities for Certificate validation. The certificate should have a valid date. It should not have a "to" date in the past (it should not be expired), and should not have a "from" date in the future. The key length used to encrypt the certificate should be 2048 bits or more. The hash used to sign the certificate should be SHA-2 or better. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).
Cara pemeriksaan
Metode audit: Tinjauan manual
Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.
Verify that the certificate being used to secure the SSL VPN meets the criteria listed. Navigate to 'System > Administration > Admin and User settings > Admin console and end-user interaction > Certificate' Ensure that a valid certificate is applied to the User portal. Navigate to 'Configure > Remote Access VPN > SSL VPN > SSL VPN global settings > SSL server certificate'. Ensure that a valid certificate is used for the SSL VPN Gateway.
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Create a CSR and install a certificate from a public CA. Navigate to 'System > Administration > Admin and User settings > Admin console and end-user interaction > Certificate'. Set a valid certificate to the User portal. Navigate to 'Configure > Remote Access VPN > SSL VPN > SSL VPN global settings > SSL server certificate'. Set a valid certificate for the SSL VPN Gateway.
Properti
- Sistem operasi
- Apa saja
- Tag
- sophoscrypto
- Referensi
- CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.1.4 Ensure SSL server certificate for remote SSL VPN is configured correctly