Ensure array TLS certificates are CA-signed, adequately sized, and rotated at least every 90 days

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

From the CLI: ; Run the command purecert list to display the active certificates on the array. ; Review the output to ensure the following for your array type certificates: ; The Issuer is a trusted Certificate Authority. ; The Key Size is at least 2048 (for RSA) or 256 (for ECDSA). ; The difference between the Valid From and Valid To dates does not exceed 90 days. ; Verify that roots of trust are explicitly stored and listed under the external Type.

修复方式

修复方法: 操作指南或基础设施补丁

To align with the security recommendations, generate a properly sized Certificate Signing Request (CSR), have it signed by your CA for a maximum of 90 days, import it, and manage your roots of trust using external certificates. From the GUI: ; Navigate to Settings > System and locate the SSL Certificate / Array Certificates panel. ; Click the menu icon and select Construct Certificate Signing Request. Fill in the required attributes and ensure the key size meets the 2048-bit RSA or 256-bit ECDSA minimums. Click Create and download the CSR. ; Submit the CSR to your organization's trusted Certificate Authority and request that the signed certificate has a lifetime of 90 days or less.