The VPN Gateway must configure OCSP to ensure revoked user certificates are prohibited from establishing an allowed session.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-264332	SRG-NET-000580	SRG-NET-000580-VPN-002431	SV-264332r984332_rule	2024-12-19	3

Description
Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before the lifetime of the certificate expires. One example is if the certificate is known to have been compromised. When an incoming Internet Key Exchange (IKE) session is initiated for a remote client or peer whose certificate is revoked, the revocation list configured for use by the VPN server is checked to see if the certificate is valid. If the certificate is revoked, IKE will fail and an IPsec security association will not be established for the remote endpoint.

Description

Situations may arise in which the certificate issued by a Certificate Authority (CA) may need to be revoked before the lifetime of the certificate expires. One example is if the certificate is known to have been compromised. When an incoming Internet Key Exchange (IKE) session is initiated for a remote client or peer whose certificate is revoked, the revocation list configured for use by the VPN server is checked to see if the certificate is valid. If the certificate is revoked, IKE will fail and an IPsec security association will not be established for the remote endpoint.

ℹ️ Check
Verify the VPN Gateway rejects user certificates that have been revoked when using DOD PKI for authentication. If the VPN Gateway does not configure OCSP and/or CRL to reject revoked user credentials that are prohibited from establishing an allowed session, this is a finding.

✔️ Fix
Configure the VPN Gateway to reject user certificates that have been revoked when using DOD PKI for authentication.