STIGQter STIGQter: STIG Summary: Oracle WebLogic Server 12c Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

Oracle WebLogic must ensure authentication of both client and server during the entire session.

DISA Rule

SV-235984r628730_rule

Vulnerability Number

V-235984

Group Title

SRG-APP-000219-AS-000147

Rule Version

WBLC-08-000223

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

1. Obtain the certificate(s) for the trusted certificate authority that signed the certificates for the client(s)
2. Access EM
3. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Security' -> 'Keystore'
4. Locate the desired keystore in which to load the client certificate(s), select and click 'Manage' button
5. From 'Manage Certificates' page, click 'Import'
6. Complete 'Certificate Type', 'Alias' and 'Certificate Source' fields and click 'OK'. Ensure the imported certificate(s) appears in the list.
7. Access AC
8. Utilize 'Change Center' to create a new change session
9. From 'Domain Structure', select 'Environment' -> 'Servers'
10. From the list of servers, select one which needs Mutual Authentication set up
11. From 'Configuration' tab -> 'SSL' tab, click 'Advanced' link
12. Set 'Two Way Client Cert Behavior' field value is set to 'Client Certs Requested And Enforced'
13. Repeat steps 7-12 for all servers requiring SSL configuration
14. From 'Domain Structure', select 'Environment' -> 'Servers', click 'Control' tab
15. Select checkbox for all servers configured in previous steps and click 'Restart SSL'

Check Contents

1. Access AC
2. From 'Domain Structure', select 'Environment' -> 'Servers'
3. From the list of servers, select one which needs check for Mutual Authentication configuration verification
4. From 'Configuration' tab -> 'General' tab, ensure 'Listen Port Enabled' checkbox is deselected
5. Ensure 'SSL Listen Port Enabled' checkbox is selected and a valid port number is in 'SSL Listen Port' field, e.g., 7002
6. From 'Configuration' tab -> 'SSL' tab, click 'Advanced' link
7. Ensure 'Two Way Client Cert Behavior' field value is set to 'Client Certs Requested And Enforced'
8. Repeat steps 3-7 for all servers requiring Mutual Authentication configuration checking

If any servers requiring Mutual Authentication do not have the 'SSL Listen Port Enabled' checkbox selected or the 'Two Way Client Cert Behavior' field value set to 'Client Certs Requested And Enforced', this is a finding.

Vulnerability Number

V-235984

Documentable

False

Rule Version

WBLC-08-000223

Severity Override Guidance

1. Access AC
2. From 'Domain Structure', select 'Environment' -> 'Servers'
3. From the list of servers, select one which needs check for Mutual Authentication configuration verification
4. From 'Configuration' tab -> 'General' tab, ensure 'Listen Port Enabled' checkbox is deselected
5. Ensure 'SSL Listen Port Enabled' checkbox is selected and a valid port number is in 'SSL Listen Port' field, e.g., 7002
6. From 'Configuration' tab -> 'SSL' tab, click 'Advanced' link
7. Ensure 'Two Way Client Cert Behavior' field value is set to 'Client Certs Requested And Enforced'
8. Repeat steps 3-7 for all servers requiring Mutual Authentication configuration checking

If any servers requiring Mutual Authentication do not have the 'SSL Listen Port Enabled' checkbox selected or the 'Two Way Client Cert Behavior' field value set to 'Client Certs Requested And Enforced', this is a finding.

Check Content Reference

M

Target Key

5282

Comments