Ensure OCSP Certificate Revocation Checking Is Enabled

보통레벨 1자동cockroachdb

설명

Online Certificate Status Protocol (OCSP) is a mechanism for checking whether a certificate has been revoked by its Certificate Authority (CA) before it expires. CockroachDB supports OCSP checking through the security.ocsp.mode cluster setting, which can be configured to verify certificate revocation status when validating client and node certificates. Runs cockroach sql with --certs-dir ${COCKROACH_CERTS_DIR:-/var/lib/cockroach/certs} (a root or admin client certificate must be in it); the target node comes from COCKROACH_HOST (default localhost:26257) or COCKROACH_URL. The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Passes when security.ocsp.mode is strict or lax (default off); strict is recommended where the OCSP responder is reliable.

점검 방법

감사 방식: SQL 쿼리

sql_query

out=$(cockroach sql --certs-dir="${COCKROACH_CERTS_DIR:-/var/lib/cockroach/certs}" --format=csv --execute "SHOW CLUSTER SETTING security.ocsp.mode;" 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk 'NR == 2 {v = tolower($0)} END {print (v == "strict" || v == "lax") ? "compliant" : "mode " v}'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

SET CLUSTER SETTING security.ocsp.mode = 'strict'; (or 'lax' if OCSP availability cannot be guaranteed) and tune security.ocsp.timeout.

속성

운영 체제: 모두
태그: cockroachdbtls
참고 자료: CIS CockroachDB v25.x Benchmark v1.0.0 - 6.5 Ensure OCSP Certificate Revocation Checking Is Enabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target cockroachdb