Verify the US DoW CCEB Interoperability Root CA cross-certificate is installed on unclassified systems as an Untrusted Certificate.
Run "PowerShell" as an administrator.
Execute the following command:
Get-ChildItem -Path Cert:Localmachine\disallowed | Where Issuer -Like "*CCEB Interoperability*" | FL Subject, NotAfter
If valid US DoW CCEB Interoperability Root CA certificates (such as those below) are not displayed, this is a finding.
Note: The Common Names (CN) below are examples. Verify the "CN" displayed is a DoW CCEB Interoperability Root CA and is not expired.
Subject: CN= US DoD CCEB Interoperability Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US
NotAfter: 12/30/2030
Alternately, use the Certificates MMC snap-in:
Run "MMC".
Select "File", then click "Add/Remove Snap-in".
Select "Certificates", then click "Add".
Select "Computer account", then click "Next".
Select "Local computer: (the computer this console is running on)", then click "Finish".
Click "OK".
Expand "Certificates" and navigate to Untrusted Certificates >> Certificates.
For each US DoW CCEB Interoperability Root CA certificate displayed:
Right-click on the certificate and select "Open".
Select the "Details" tab.
Scroll to the bottom and select "Subject".
If any of the certificates listed do not include "DoD Interoperability Root CA" in the name or are expired, this is a finding.
US DoD CCEB Interoperability Root CA 2
Note: Interoperability cross certificates will have a different value (such as "...Root CA 6") in the 'Issued To' field than in the 'Subject' and 'Issuer' fields.