TMA-CHROME-1.11
Ensure 'Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes' is set to 'Disabled'
Mô tả
Google Chrome can exclude certificates by their subjectPublicKeyInfo hashes from enforcing Certificate Transparency requirements. If this setting is disabled, no certificates are excluded from Certificate Transparency requirements. The recommended state for this setting is: Disabled (0) Rationale: Certificate Transparency requirements shall be enforced for all certificates. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas is missing or empty, otherwise the configured entries.
Cách kiểm tra
Phương pháp kiểm tra: Windows Registry
$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }- Đầu ra mong đợi
absent
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas after reviewing them.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- chromebrowsercis-l1
- Tham chiếu
- CIS Google Chrome Benchmark v3.0.0 - 1.11 Ensure 'Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes' is set to 'Disabled'
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target chrome