Verify the DoW Interoperability cross-certificates are installed on unclassified systems as Untrusted Certificates.
Run "PowerShell" as an administrator.
Execute the following command:
Get-ChildItem -Path Cert:Localmachine\disallowed | Where {$_.Issuer -Like "*DoD Interoperability*" -and $_.Subject -Like "*DoD*"} | FL Subject, NotAfter
If valid DoW Interoperability cross-certificates (such as those below) are not displayed, this is a finding.
Subject: CN=DoD Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
NotAfter: 11/24/2030
Alternately, use the Certificates MMC snap-in:
Run "MMC".
Select "File", "Add/Remove Snap-in".
Select "Certificates", click "Add".
Select "Computer account", click "Next".
Select "Local computer: (the computer this console is running on)", click "Finish".
Click "OK".
Expand "Certificates" and navigate to Untrusted Certificates >> Certificates.
For each DoW Interoperability Root CA certificate displayed:
Right-click on the certificate and select "Open".
Select the "Details" tab.
Verify the Expiration Date is a future date.
Scroll to the bottom and select "Subject".
If any of the certificates listed do not include "DoD Interoperability Root CA" in the name or are expired, this is a finding.
Note: This should not be relied upon as a complete list of possible DoW Interoperability Root CA certificates.
DoD Interoperability Root CA 2
Note: Interoperability cross certificates will have a different value (such as "...Root CA 6") in the 'Issued To' field than in the 'Subject' and 'Issuer' fields.