IBM WebSphere Traditional V9.x Security Technical Implementation Guide

The IBM WebSphere Traditional V9.x Security Technical Implementation Guide (V2 R2) has 76 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

76STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R2

CurrentPublished Wed Sep 30 2026 What changed in V2R2

The WebSphere Application Server must not generate LTPA keys automatically.

IBM WebSphere Traditional V9.x Security Technical Implementation Guide

Assessment Title

Rule Text

The WebSphere Application Server must not generate LTPA keys automatically.

Description

Discussion Text

Automated LTPA key generation can create unplanned outages. Plan to change your LTPA keys during a scheduled outage. Distribute the new keys to all nodes in the cell and to all external systems/cells during this outage window.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-255883

Rule

SV-255883r1265360_rule

Severity

low

Rule Version

WBSP-AS-001520

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If LTPA is not utilized, this is not applicable.

Request the documented process to manually regenerate the LTPA keys.

The time period for regeneration must be defined, documented, and accepted by the ISSO but must be performed at least annually.

Navigate to Security >> SSL Certificate and Key Management >> Key set groups >> Cell LTPAKeySetGroup.

If automatically generate keys is checked, this is a finding.

Implementation Procedure

Fix Text

Navigate to Security >> SSL Certificate and Key Management >> Key set groups >> Cell LTPAKeySetGroup.

Uncheck automatically generate keys.

Click "OK".

Click "Save".

Restart the "Deployment Manager".

STIG check 65 of 76 in the IBM WebSphere Traditional V9.x STIG checklist

← Previous · V-255882The WebSphere Application servers with an RMF categorization of high must be in a high-availability (HA) cluster.Next · V-255884 →The WebSphere Application Server must periodically regenerate LTPA keys.