Verify the ECA Root CA certificates are installed on unclassified systems as Trusted Root Certification Authorities.
Run "PowerShell" as an administrator.
Execute the following command:
Get-ChildItem -Path Cert:Localmachine\root | Where Subject -Like "*ECA*" | FL Subject, NotAfter
If valid ECA Root CA certificates (such as those below) are not displayed, this is a finding.
Note: The Common Names (CN) below are examples. Verify the "CN" displayed (ECA Root CA) is not expired. As of this writing, ECA Root CA 4 and ECA Root 5 are valid (among others).
Subject: CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US
Subject: CN=ECA Root CA 5, OU=ECA, O=U.S. Government, C=US
Alternately, use the Certificates MMC snap-in:
Run "MMC".
Select "File" and "Add/Remove Snap-in".
Select "Certificates" and click "Add".
Select "Computer account" and click "Next".
Select "Local computer: (the computer this console is running on)" and click "Finish".
Click "OK".
Expand "Certificates" and navigate to Trusted Root Certification Authorities >> Certificates.
For each ECA Root CA certificate displayed:
Right-click on the certificate and select "Open".
Select the "Details" tab.
Verify the Expiration Date is a future date.
Scroll to the bottom and select "Subject".
If any of the certificates listed do not include "ECA Root CA" in the name or are expired, this is a finding.
Note: This should not be relied upon as a complete list of possible ECA Root CA certificates.
ECA Root CA 4
ECA Root CA 5