THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · SC-17

Public Key Infrastructure Certificates

US National Institute of Standards and Technology (NIST) · cited in 5 of our lessons

Explanation

What it asks for. Public key certificates must be issued under a defined certificate policy or obtained from an approved service provider, and only approved trust anchors may be included in trust stores or certificate stores.

In practice. Doing this well means a certificate inventory, automated issuance and renewal, a governed internal PKI with protected root keys and control over which root certificates devices trust. Auditors look for the certificate policy, inventory, renewal processes and trust store configuration. Short-lived certificates with automated renewal through protocols such as ACME reduce risk.

Common gaps. Certificates expiring unexpectedly and causing outages is common, as is shadow PKI created by individual teams. Unmanaged trust stores may include roots that should not be trusted. Private keys are also frequently stored without protection on servers.

Open SP 800-53 at NIST
The official text
a. Issue public key certificates under an [Assignment: organization-defined certificate policy] or obtain public key certificates from an approved service provider; and b. Include only approved trust anchors in trust stores or certificate stores managed by the organization. Discussion: Public key infrastructure (PKI) certificates are certificates with visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (i.e., a certificate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.