Ensure array TLS certificates are CA-signed, adequately sized, and rotated at least every 90 days

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

From the CLI: ; Run the command purecert list to display the active certificates on the array. ; Review the output to ensure the following for your array type certificates: ; The Issuer is a trusted Certificate Authority. ; The Key Size is at least 2048 (for RSA) or 256 (for ECDSA). ; The difference between the Valid From and Valid To dates does not exceed 90 days. ; Verify that roots of trust are explicitly stored and listed under the external Type.

修正方法

修正方法: ガイダンスまたは IaC パッチ

To align with the security recommendations, generate a properly sized Certificate Signing Request (CSR), have it signed by your CA for a maximum of 90 days, import it, and manage your roots of trust using external certificates. From the GUI: ; Navigate to Settings > System and locate the SSL Certificate / Array Certificates panel. ; Click the menu icon and select Construct Certificate Signing Request. Fill in the required attributes and ensure the key size meets the 2048-bit RSA or 256-bit ECDSA minimums. Click Create and download the CSR. ; Submit the CSR to your organization's trusted Certificate Authority and request that the signed certificate has a lifetime of 90 days or less.