HTTPS (web) client protocol
For compliance, use FIPS 140-3 mode, TLS 1.0 or better, compliant ciphers, and certificate authentication for HTTPS communications other than DTI.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
web client ssl cert-verify
web client ssl min-version tls1
web client ssl cipher-list {fips | fips-high-security | cc-ndpp | cc-ndpp-high-security | fips-and-cc-ndpp | fips-and-cc-ndpp-high-security}
CLI show command
show web
HTTPS (web) server HTTPS protocol
For FIPS and CC-NDcPP compliance mode configuration, the HTTPS server enforces TLSv1.2 protocol version, this is in addition to ciphers compliant certified for the selected standard and cipher-level in the compliance apply command.
The HTTPS server certificate verification at connection time is a function of the client, for example the browser in a client server relationship. You can also use the appliance in the server relationship to verify your web server certificate in local configuration after installing the root trust chain certificate. First add the server’s CA chain of certificate to configuration, then configure them to the supplemental default-ca-list with the following command:
crypto certificate ca-list default-ca-list <trusted-ca-cert-name>
FIPS 140-3 compliance mode requires the appliance to verify its server certificate, CC-NDcPP compliance does not.
To enforce verification for the web server certificate for CC-NDcPP mode, use the following compliance criterion "Compliance configuration protection". For full CC-NDcPP compliance, install the web server certificate and its trusted chain. If the web server certificate is not showing as verified, use the crypto certificate reverify command.
Caution
In releases prior to 10.0.0, the system-self-signed certificate auto-generated by the appliance was accepted and marked as self-verified and marked. It served compliance without any CA trust chain. In 10.0.0, self-verification of the default generated system certificate is not available. An externally signed and verified certificate is required for CC-NDcPP compliance, configure this prior to compliance apply.
Upgraded compliant systems might have a previously marked as verified system-self-signed certificate in use by the web server, and this will continue to show as compliant in 10.0.0. Stop using this system certificate.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
web server ssl min-version {tls1 | tls1.1| tls1.2}
web server ssl cipher-list {fips | fips-high-security | cc-ndpp | cc-ndpp-high-security | fips-and-cc-ndpp | fips-and-cc-ndpp-high-security}
CLI show command
show web
Hardware model check
For compliance, the hardware model must be one that has been certified for FIPS 140-3 compliance. See Supported Hardware Platforms.
Standards
FIPS 140-3, CC-NDcPP
CLI show command
show version