TMA-SOPHOS-1.1.4

Ensure SSL server certificate for remote SSL VPN is configured correctly

CaoCấp 2Xem xét thủ côngsophos

Mô tả

The Certificate used to secure SSL VPN should satisfy the following criteria. It should be a valid certificate from a trusted source. In most cases this means a trusted Public Certificate Authority as remote sslvpn users may not have access to any Private Certificate Authorities for Certificate validation. The certificate should have a valid date. It should not have a "to" date in the past (it should not be expired), and should not have a "from" date in the future. The key length used to encrypt the certificate should be 2048 bits or more. The hash used to sign the certificate should be SHA-2 or better. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Verify that the certificate being used to secure the SSL VPN meets the criteria listed. Navigate to 'System > Administration > Admin and User settings > Admin console and end-user interaction > Certificate' Ensure that a valid certificate is applied to the User portal. Navigate to 'Configure > Remote Access VPN > SSL VPN > SSL VPN global settings > SSL server certificate'. Ensure that a valid certificate is used for the SSL VPN Gateway.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Create a CSR and install a certificate from a public CA. Navigate to 'System > Administration > Admin and User settings > Admin console and end-user interaction > Certificate'. Set a valid certificate to the User portal. Navigate to 'Configure > Remote Access VPN > SSL VPN > SSL VPN global settings > SSL server certificate'. Set a valid certificate for the SSL VPN Gateway.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: sophoscrypto
Tham chiếu: CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.1.4 Ensure SSL server certificate for remote SSL VPN is configured correctly