Verify the DoW Root CA certificates are installed as Trusted Root Certification Authorities.
The certificates referenced below apply to unclassified systems; refer to PKE documentation for other networks.
Run "PowerShell" as an administrator.
Execute the following command:
Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*DoD*" | FL Subject, NotAfter
If valid (and unexpired) DoW Root CA certificates (like those below) are not listed, this is a finding.
Note: The Common Names (CN) below are examples. Verify that the "CN" displayed is a DoW Root CA and is not expired.
Subject: CN=DoD Root CA 3, OU=PKI, OU=DoD, O=U.S. Government, C=US
NotAfter: 12/30/2029
Subject: CN=DoD Root CA 5, OU=PKI, OU=DoD, O=U.S. Government, C=US
NotAfter: 6/14/2041
Subject: CN=DoD Root CA 6 OU=PKI, OU=DoD, O=U.S. Government, C=US
NotAfter: 1/24/2053
Alternately, use the Certificates MMC snap-in:
Run "MMC".
Select "File" and "Add/Remove Snap-in".
Select "Certificates" and click "Add".
Select "Computer account" and click "Next".
Select "Local computer: (the computer this console is running on)" and click "Finish".
Click "OK".
Expand "Certificates" and navigate to Trusted Root Certification Authorities >> Certificates.
For each of the DoW Root CA certificates noted below:
Right-click on the certificate and select "Open".
Select the "Details" tab.
Verify that the Expiration Date is a future date.
Scroll to the bottom and select "Subject".
If valid (and unexpired) DoW Root CA certificates (such as those below) are not listed, this is a finding.
DoD Root CA 3
DoD Root CA 5
DoD Root CA 6