[non-validated] Question C: Certificate-Based Authentication for Remote Access

Generated catalog draft. No operational assessment or human approval is claimed.

[non-validated] This question has unresolved selected work.

Question

[non-validated] Has certificate-based authentication using X.509 certificates from a trusted Certificate Authority been implemented for all remote access systems requiring peer identification?

Explanation

[non-validated] Has certificate-based authentication using X.509 certificates from a trusted Certificate Authority been implemented for all remote access systems requiring peer identification during the current assessment period?

Criterion and evidence

Verifies implementation of X.509 certificate authentication with trusted CA validation for remote access systems requiring peer identification. Requires evidence of configuration against Red Hat RHEL10 standards (Section 6.2) showing certificate validation mechanisms, handling of certificate revocation via CRL/OCSP (Section 6.5.1), and network boundary controls against SLAAC/DHCP vulnerabilities (Section 6.11 reference). Alternatives: OCSP for real-time validation where CRL impractical.

AI assistance prompt

Replace this placeholder with one clear yes/no condition within the scope of Networking and VPNs. Define the evidence rule and keep the question within 512 characters. Do not invent an assessment outcome.

Clarifications

What constitutes sufficient evidence for certificate implementation?

Official configuration documentation must demonstrate X.509 certificate validation against trusted CA root certificates for all remote access systems requiring peer identification. Acceptable evidence includes TLS 1.3 implementation logs showing certificate chains and security group rules enforcing certificate validation. Missing evidence remains pending.

How are certificate revocation mechanisms handled?

Evidence must show automatic use of certificate revocation lists (CRL) or Online Certificate Status Protocol (OCSP) per Red Hat guidance. OCSP is acceptable when CRL distribution is impractical, but temporary certificate validity periods must be documented. Pending evidence regarding revocation status prevents positive assessment.

References

Red Hat Enterprise Linux 10: Setting up an IPsec VPN

https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/securing_networks/setting-up-an-ipsec-vpn (opens in a new tab)

AWS Site-to-Site VPN - AWS Documentation

https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html (opens in a new tab)