Ensure a Valid Trusted Certificate Is Installed

中级别 1人工审核apache

说明

The default SSL certificate is self-signed and is not trusted. Install a valid certificate signed by a commonly trusted certificate authority. To be valid, the certificate must be: Signed by a trusted certificate authority Not be expired, and Have a common name that matches the host name of the web server, such as www.example.com. Note ... Manual review: the benchmark gives no reliable automated check for this control.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Perform one or more of the following steps to determine if the recommended state is implemented: 1. The Qualys SSL Labs has a website that may be used for testing external servers. https://www.ssllabs.com/ssltest/ Enter the external host name of the server and wait for an extensive tests of TLS protocols and ciphers, in addition to testing the server certificate and the entire certificate authority chain. The SSL Labs test will report any weak digital signatures of the intermediate certificate authorities. For example, the report may include a warning of ...

修复方式

修复方法: 操作指南或基础设施补丁

Perform the following to implement the recommended state: 1. Decide on the host name to be used for the certificate. It is important to remember that the browser will compare the host name in the URL to the common name in the certificate, so that it is important that all https: URL's match the correct host name. Specifically, the host name www.example.com is not the same as example.com nor the same as ssl.example.com. 2. Generate a private key using openssl. Although certificate key lengths of 1024 have been common in the past, a key length of 2048 is now recommended for strong authentication. The key must be kept confidential and will be encrypted with a passphrase by default. Follow the steps below and respond to the prompts for a passphrase. See the Apache or OpenSSL documentation for details ...

属性

操作系统: 任意
标签: apachetls
参考: CIS Apache HTTP Server 2.4 Benchmark v2.4.0 - 7.2 Ensure a Valid Trusted Certificate Is Installed