WIXLIB

Uploaded web server certificate will be validated/checked for all criteria asmentioned in Section 4.4 with title “All certificate will be validated for belowchecks:”.D. On successful validation of web server certificate, web service of MATDwill restart to make use of new certificate.In case of any certificate validation failure a pop-up message will be displayedshowing failure reason. Admin will get the opportunity to accept the risk andcontinue uploading web server certificate like below.There are some mandatory checks for which certificates will be rejectedwithout giving any option to admin user.4.3Configuring Syslog ServerMATD can be configured for sending syslog events/audits/logs to remoteSyslog server for monitoring purpose. MATD supports syslog messages overUDP, TCP and TCP with TLS protocols. For CC mode of operation Syslog mustuse “TCP/TLS Encryption” protocol only.Steps to configure remote syslog server settings:A. Navigate to Manage ATD Configuration Syslog tab.B. Select “Enable Logging” and configure valid IP address/hostname,protocol as TCP/TLS Encryption and port number (default is 6514) asshown below.C. “Validate Syslog Server Certificate” should be checked for CC mode ofoperation. This will enable MATD to validate syslog server certificatepresented at the time of connection establishment.McAfee Advanced Threat Defense 4.12Configuration Guide for Common Criteria Evaluation

Make sure the root CA of syslog server certificate is uploaded to Trusted CAbundle of MATD else trust establishment will fail. Refer to section 4.2“Uploading CA certificate to trusted CA bundle” for more details.D. Using “Test Connection” button, admin can check reachability to syslogserver. If connection test is successful, a Success pop-up message willbe shown as below:E. Check “Audit Log” checkbox, it is a mandatory step for enabling Auditfunction for Common Criteria of operation. By default, this setting willbe enabled.F. Click “Submit” button.G. In case of syslog server certificate validation failure, MATD will displaya pop-up message providing the details of the validationfailures/errors. Below is one such example.McAfee Advanced Threat Defense 4.12Configuration Guide for Common Criteria Evaluation

There are some mandatory checks for which certificates will be rejectedwithout giving any option to admin user.4.4Certificate validationAll certificate will be validated for below checks:A.B.C.D.E.F.G.H.I.Expiry date and time.CA flag if not end certificate.Certificate key size should be greater or equal to 2048Certificate signature methods: sha256, sha384, sha512Certificate presented identifier (hostname/IP) should match an entry inSAN or CN (if match not found in SAN) (Refer section: 4.7 – Referenceidentifier for further details)Wildcard validation of SAN or CN filed for presented identifier, it shouldbe in the left-most domain level and there shouldn’t be more than onewildcard in any of the entriesCertificate chain validation. Root CA must be trusted by MATD.Certificate revocation check using CRL. Authority information access(AIA) URL is must for checking revocation status, MATD accepts onlyHTTP URL in AIA.X509v3 Extended Key Usage for purpose like server authentication,client authentication and certificate signing.Certificate validation criteria in detail:Syslog certificate:The following are mandatory criteria, failing which, the user must rectifythem and upload a valid certificate: The syslog server certificate’s root certificate must be uploaded in thetrusted CA bundle of the ATD which uses the syslog server.Private key of syslog server certificate must be configured along withthe certificate.McAfee Advanced Threat Defense 4.12Configuration Guide for Common Criteria Evaluation

Any of the certificates in the chain of the web certificate including itselfshould not have expired.Extended key usage extension should have ‘Server Authentication’purpose.Public key size should not be lesser than 2048 bits.Supported signature algorithms: sha 256, sha 384 and sha 512.Certificate chain validation should pass for the certificate.Certificate should not be corrupted.If OCSP URl is present and reachable: Extended key usage should have ‘OCSP Signing’ purpose. The certificate should not be revoked.When OCSP URI is absent: The certificate should not be revoked. CRL URI must be present in certificate and should be reachable.Hostname validation and wildcard checks:In case Subject Alternative Name field (SAN) is present in thecertificate: Presented hostname should match Subject Alternative name(SAN) field.Wildcard if present in any SAN entry must be present only inleftmost domain level.More than one wildcard must not be present in any entry ofSubject Alternative Name (SAN) field.When the SAN field is absent: Presented hostname should match Common name (CN) field.Wildcard if present in CN field must be present only in leftmostdomain level.More than one wildcard must not be present in Common name(CN) field.Please note that in the case of syslog server, since a user must upload avalid certificate to proceed with the configuration, if/when the certificatebecomes invalid post upload, the connection between the ATD and syslogserver is disconnected and the user is intimated of the same via Audit logsand security logs in ATD.Web certificate:McAfee Advanced Threat Defense 4.12Configuration Guide for Common Criteria Evaluation

The following are mandatory criteria, failing which, the user must rectifythem and upload a valid certificate: The web server certificate’s root certificate must be uploaded in thetrusted CA bundle of the ATD which uses the syslog server.Private key must be appended to the certificate.Certificate should not be corrupted.The following certificate failures are communicated to the user who can thenchoose to accept the failures in the certificate and proceed using it, or rectifythem and upload a valid certificate: Any of the certificates in the chain of the web certificate including itselfhas expired.Extended key usage extension does not have ‘Server Authentication’purpose.Public key size lesser than 2048 bits.Signature algorithms other than sha 256, sha 384, sha 512 used.Certificate chain validation failure when parent URL of the certificatesin the chain are not reachable.If OCSP URl is present and reachable: Extended key usage does not have ‘OCSP Signing’ purpose. The certificate has been revoked.When OCSP URI is absent:The certificate has been revoked.CRL URI is not found in certificate or other certificate validationissues reported by openssl verify -crl check.Hostname validation and wildcard checks: In case Subject Alternative Name field (SAN) is present in thecertificate: Presented hostname does not match Subject Alternative name(SAN) field.Wildcard present in domain level other than the leftmost of aSAN entry.More than one wildcard is present in an entry of SubjectAlternative Name (SAN) field.When the SAN field is absent: Presented hostname does not match Common name (CN) field.McAfee Advanced Threat Defense 4.12Configuration Guide for Common Criteria Evaluation

Wildcard present in domain level other than the leftmost of CNfield.More than one wildcard is present in Common name (CN) field.Trusted CA certificate:The following are mandatory criteria, failing which, the user must rectifythem and upload a valid certificate: The root certificate of the certificate chain must be uploaded as atrusted CA certificate before uploading any of the intermediatecertificate as trusted CA certificates.Basic constraints extension is present.CA flag must be set to true.The trusted CA certificates must be uploaded one at a time.Certificate should not be corrupted.The following certificate failures are communicated to the user who can thenchoose to accept the failures in the certificate and proceed using it, or rectifythem and upload a valid certificate: Any of the certificates in the chain of the trusted certificate includingitself has expired.Certificate chain validation failure when parent URL of uploadedcertificate is not reachable.Public key size lesser than 2048 bits.Signature algorithms other than sha 256, sha 384, sha 512 used.If OCSP URl is present and reachable: Extended key usage does not have ‘OCSP Signing’ purpose. The certificate has been revoked.When OCSP URI is absent: 4.5The certificate has been revoked.CRL URI is not found in certificate or other certificate validationissues reported by openssl verify -crl check.Enabling Common Criteria ModeMATD supports Common Criteria mode of operation. Admin can enable ordisable Common Criteria mode by changing configuration.Please note that on enabling Common Criteria mode port 2222 will getdisabled automatically which is used for SSH to MATD.Steps to Enable Common Criteria Mode:McAfee Advanced Threat Defense 4.12Configuration Guide for Common Criteria Evaluation

A. Enable remote logging with syslog server configured to use “TCP/TLSEncryption” protocol, enable “Validate Syslog Server Certificate” andenable “Audit Log”. For more details check section 4.3 “ConfiguringSyslog Server”B. Upload a valid web server certificate to MATD. Check section 4.2“Uploading web server certificate” for more details.C. Navigate to Manage Security Advanced Security Settings.D. Check “Common Criteria Mode” checkbox, and the MATD system willcheck the Common Criteria eligibility.McAfee Advanced Threat Defense 4.12Configuration Guide for Common Criteria Evaluation

E. If not eligible, a failure pop-up message box will show the failurereason(s). Admin user can either accept the risk and continue with thecertificates having not met the requirements or can click on cancelbutton to stop the process.McAfee Advanced Threat Defense 4.12Configuration Guide for Common Criteria Evaluation

Below is one such example of pop-up message:F. Click on “Save” button.4.6Certificate Signing RequestGenerating a Certificate Signing Request:Advanced Threat Defense allows you to generate a certificate signingrequest (CSR) from the web interface.To generate a CSR, you need to enter your organization details, and the keysize. You can then generate your CSR, export it, and submit it to a certificatesigning authority to get it signed.Steps for CSR generation:A. Log on to the Advanced Threat Defense web interface.B. Click Manage Security CSR Generation.C. Fill the CSR Generation fields with your organization details.a. Common Name [CN] – Enter the domain name of yourorganization.b. Organization Name [O] – Enter your organization name.c. Organization Unit [OU] – Enter the organization unit that isordering the certificated. City/Town [L], State/Province [ST], Country [C] – Enter theaddress of your organization.e. Email Id [ea] – Enter the email address to contact yourorganization.f. Hash Function – Select a hash function for your certificate.g. Key Size (in bits) – Select a key size for your certificate in bits.McAfee Advanced Threat Defense 4.12Configuration Guide for Common Criteria Evaluation

D. Click Generate to generate your CSR. Your CSR is now listed in theCertificate Signing Request Message section. You can use the icon inthe Action column to Export or Remove your CSR. Once the certificateis signed, you can upload it as Web Certificate from the ManageCertificate page.4.7Reference IdentifierMATD validates the presented hostname, IP Address and FQDN asreferenced identifier for Syslog and Web server certificates.In the case of Syslog, MATD takes the IP Address or FQDN configured in “IPAddress/Hostname” field available in Manage ATD Configuration Syslog page.In the case of Web certificate, MATD uses the IP address or thehostname/FQDN set for the device as referenced identifier. First, configuredIP address is tried for match in SAN/CN field of certificate and thenhostname/FQDN.The comparison of the hostname happens against the entries in SubjectAlternative Name (SAN) field of the respective server certificate and if nomatch is found, we look for a match with CN field of the certificate. Also, ifthe SAN field is absent, the match would happen against CN.McAfee Advanced Threat Defense 4.12Configuration Guide for Common Criteria Evaluation

Note that although IP addresses can be used for identity verification incertificates, it is recommended that FQDN be used for stronger security.4.8Supported CiphersMATD supports below list of Ciphers when Common Criteria mode isenabled.For nginx(web) server, port 443: TLS DHE RSA WITH AES 128 GCM SHA256TLS DHE RSA WITH AES 256 GCM SHA384TLS ECDHE RSA WITH AES 128 GCM SHA256TLS ECDHE RSA WITH AES 256 GCM SHA384TLS ECDHE RSA WITH AES 128 CBC SHA256For syslog communication: 4.9TLS DHE RSA WITH AES 128 GCM SHA256TLS DHE RSA WITH AES 256 GCM SHA384TLS ECDHE ECDSA WITH AES 128 GCM SHA256TLS ECDHE ECDSA WITH AES 256 GCM SHA384TLS ECDHE RSA WITH AES 128 GCM SHA256TLS ECDHE RSA WITH AES 256 GCM SHA384TLS RSA AES 128 GCM SHA256TLS RSA AES 256 GCM SHA384Audit LogsSee complete list of Audit logs/events in the Appendix A.The audit logs corresponding to the events are simultaneously sent to theexternal syslog server and local store.MATD rotates local audit log file r

McAfee Advanced Threat Defense 4.12 Configuration Guide for Common Criteria Evaluation Configuration Guide for Common Criteria Evaluation McAfee Advanced Threat Defense 4.12