V-218749
SV-218749r1111805_rule
CAT II
A private IIS 10.0 website authentication mechanism must use client certificates to transmit session identifier to assure integrity.
From: Microsoft IIS 10.0 Site Security Technical Implementation Guide (V2R15)
Description
<VulnDiscussion>A DoD private website must use PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring authorization based on individual identity must use the identity provided by certificate-based authentication to support access control decisions. Not using client certificates allows an attacker unauthenticated access to private websites.
Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
Check Procedure
Note: If the server being reviewed is a public IIS 10.0 web server, this is not applicable.
Note: If the server being reviewed is hosting SharePoint, this is not applicable.
Note: If the server being reviewed is hosting WSUS, this is not applicable.
Note: If certificate handling is performed at the Proxy/Load Balancer, this is not applicable.
Note: If the server being reviewed is hosting Simple Certificate Enrollment Services (SCEP), this is not applicable.
Note: If the server being reviewed is hosting Network Device Enrollment Services (NDES), this is not applicable.
Note: If the server is providing OCSP, and not otherwise hosting any content, this requirement is not applicable.
Follow the procedures below for each site hosted on the IIS 10.0 web server:
Open the IIS 10.0 Manager.
Double-click the "SSL Settings" icon.
Verify the "Clients Certificate Required" check box is selected.
If the "Clients Certificate Required" check box is not selected, this is a finding.
Fix Text
Follow the procedures below for each site hosted on the IIS 10.0 web server:
Open the IIS 10.0 Manager.
Double-click the "SSL Settings" icon.
Verify the "Clients Certificate Required" check box is selected.
Select "Apply" from the "Actions" pane.
CCI Reference
CCI-000197,CCI-001188,CCI-002470- Created
- 2026-01-14 17:55:45
- Last Updated
- 2026-04-07 20:09:05