Ensure that mutual TLS on a listener rejects clients that do not present a valid certificate from a trusted authority.
Validate Client Certificates
CCC.LB.CN13 · Access
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.LB.CP26 | Mutual TLS Client Authentication | The service may be configured to require and validate client certificates during the TLS handshake, rejecting connections from clients that do not present a certificate issued by a trusted authority. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.LB.TH10 | Client Certificate Validation Is Bypassed | Mutual TLS may be configured in passthrough mode, with a trust store that contains untrusted certificate authorities, or without revocation checking. Clients that present no certificate or a revoked one are then forwarded to backend targets as if authenticated, compromising the confidentiality and integrity of the resources behind the load balancer. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.LB.CN13.AR01 | When mutual TLS is enabled on a listener, the listener MUST operate in verify mode rather than passthrough mode. | tlp-amber, tlp-red |
| CCC.LB.CN13.AR02 | When mutual TLS is enabled on a listener, the listener MUST check the revocation status of the presented client certificate. | tlp-amber, tlp-red |