Ensure Non-Default, Unique Cryptographic Material is in Use

OrtaDüzey 1Manuel incelememariadb

Açıklama

The cryptographic material used by MariaDB, such as digital certificates and encryption keys, should be used only for MariaDB and only for one instance. Default cryptographic material should not be used since it is not unique to the instance.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Review all cryptographic material: openssl x509 -in <datadir or ssl_cert>/server-cert.pem -subject -noout | grep Auto_Generated_Server_Certificate. Any output (auto-generated cert) or material shared with other instances/purposes is a finding.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Issue a unique certificate and key from your CA for this instance, set ssl_cert/ssl_key/ssl_ca under [mariadbd], and restart or run ALTER INSTANCE RELOAD TLS (MariaDB: FLUSH SSL).

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: mariadbdatabasetlscryptomanual
Referans: CIS MariaDB 10.11 Benchmark v1.0.0 - 2.5 Ensure Non-Default, Unique Cryptographic Material is in Use