The STIG rule 'Configure GnuTLS library to use DoD-approved TLS Encryption' remediates a correct RHEL default configuration.
See screenshot of the finding

To my understanding the fidnding is the same as the default RHEL provided configured, only the swapped order to excluded ssl3,tls1.0,tls1.1 is swapped

Order expected by SCAP check
+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0

Order by RedHat default:
+VERS-ALL:-VERS-DTLS0.9:-VERS-TLS1.1:-VERS-TLS1.0:-VERS-SSL3.0:-VERS-DTLS1.0

Below the output of RHEL8.7 that shows that this order is always the same there for all back-ends and not matching the STIG order even not for the expected FIPS crypto profile:
~~~
[Azure] vrempet-admin@hiltiq.com@li-lc-2635 ~
$ rpm -q crypto-policies
crypto-policies-20211116-1.gitae470d6.el8.noarch

[Azure] vrempet-admin@hiltiq.com@li-lc-2635 ~
$ grep -o '+VERS.:+COMP' /usr/share/crypto-policies/back-ends//gnutls.config
/usr/share/crypto-policies/back-ends/DEFAULT/gnutls.config:+VERS-ALL:-VERS-DTLS0.9:-VERS-TLS1.1:-VERS-TLS1.0:-VERS-SSL3.0:-VERS-DTLS1.0:+COMP
/usr/share/crypto-policies/back-ends/FIPS/gnutls.config:+VERS-ALL:-VERS-DTLS0.9:-VERS-TLS1.1:-VERS-TLS1.0:-VERS-SSL3.0:-VERS-DTLS1.0:+COMP
/usr/share/crypto-policies/back-ends/FUTURE/gnutls.config:+VERS-ALL:-VERS-DTLS0.9:-VERS-TLS1.1:-VERS-TLS1.0:-VERS-SSL3.0:-VERS-DTLS1.0:+COMP
/usr/share/crypto-policies/back-ends/LEGACY/gnutls.config:+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:+COMP
~~~

There are 3 Solutions:

• Make the SCAP check more advanced to check for +VERS-ALL: and then for each not to exclude VERS independent of the order (as long as it is after the +VERS-ALL)
• Update the RedHat defaults to match SCAP
• Update the SCAP expected order to match the RedHat defaults

Reproducer run STIG remediate on

• update-crypto-policies --set FIPS
• run STIG SCAP

Result:

• Finding on 'Configure GnuTLS library to use DoD-approved TLS Encryption'

Expected:

• No finding 'Configure GnuTLS library to use DoD-approved TLS Encryption'

What is the business impact? Please also provide timeframe information.
Unneeded finding/remediate of a configuration