Ensure OCSP Certificate Revocation Checking Is Enabled

中等級 1自動化cockroachdb

說明

Online Certificate Status Protocol (OCSP) is a mechanism for checking whether a certificate has been revoked by its Certificate Authority (CA) before it expires. CockroachDB supports OCSP checking through the security.ocsp.mode cluster setting, which can be configured to verify certificate revocation status when validating client and node certificates. Runs cockroach sql with --certs-dir ${COCKROACH_CERTS_DIR:-/var/lib/cockroach/certs} (a root or admin client certificate must be in it); the target node comes from COCKROACH_HOST (default localhost:26257) or COCKROACH_URL. The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Passes when security.ocsp.mode is strict or lax (default off); strict is recommended where the OCSP responder is reliable.

檢查方式

稽核方法: SQL 查詢

sql_query

out=$(cockroach sql --certs-dir="${COCKROACH_CERTS_DIR:-/var/lib/cockroach/certs}" --format=csv --execute "SHOW CLUSTER SETTING security.ocsp.mode;" 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk 'NR == 2 {v = tolower($0)} END {print (v == "strict" || v == "lax") ? "compliant" : "mode " v}'

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

SET CLUSTER SETTING security.ocsp.mode = 'strict'; (or 'lax' if OCSP availability cannot be guaranteed) and tune security.ocsp.timeout.

屬性

作業系統: 不限
標籤: cockroachdbtls
參考資料: CIS CockroachDB v25.x Benchmark v1.0.0 - 6.5 Ensure OCSP Certificate Revocation Checking Is Enabled

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target cockroachdb