第 6 章，共 8 章
Eight well-known ADCS misconfigurations, the condition behind each, and the control that closes it.
约 14 分钟阅读
Researchers catalogued the ways an ADCS configuration can hand out credentials it should not. They are numbered ESC1 to ESC16 as the field grew. You do not need all of them for a first course, but you must understand the pattern: a policy mistake turns certificate issuance into identity impersonation.
| Issue | Condition | Control |
|---|---|---|
| ESC1 | Template lets the requester supply the subject, with an authentication EKU and broad enrolment | Disable supply-in-request, require approval, narrow enrolment rights |
| ESC2 | Template with Any Purpose or no EKU that can be enrolled | Restrict EKU; remove unused templates |
| ESC3 | Enrolment agent template usable by ordinary users | Restrict agent templates to dedicated accounts, require approval |
| ESC4 | Write access to the template object | Tighten ACLs on templates and the PKI container |
| ESC5 | Write access to CA objects in AD | Audit ACLs on the CA object and NTAuthCertificates |
| ESC6 | CA-wide flag allows a SAN in any request (EDITF_ATTRIBUTESUBJECTALTNAME2) | Disable the flag, restart the service, patch the CA |
| ESC7 | Manage CA or Manage Certificates granted too widely | Limit CA roles to named administrators |
| ESC8 | HTTP enrolment endpoints reachable for NTLM relay | Require HTTPS with Extended Protection for Authentication, or remove web enrolment |
Newer variants (ESC9 to ESC16) explore weaker certificate mapping, missing security extensions, and schema version 1 templates that let a requester override the EKU. The defensive principle is unchanged: control the subject, the purpose, the permissions and the endpoint.
ESC1 needs no vulnerability in Windows. It needs a template with three ordinary-looking settings: the requester may supply the subject, the certificate is valid for client authentication, and a broad group can enrol. A user then requests a certificate with an administrator's name in the subject and logs in as that administrator.
Find the template
Enumerate published templates and their effective permissions.
Request
Submit a request specifying another identity, if the template allows it.
Receive
The CA issues a certificate that is cryptographically valid.
Authenticate
Present the certificate to obtain a Kerberos ticket for the impersonated account.
Persist
The certificate keeps working after a password reset until it expires or is revoked.
Modern Windows updates enforce stronger certificate-to-account mapping, which breaks some ESC paths but not all. A control that fixes one issue can leave another open, so assessments must look at combinations rather than individual settings.
Requester-supplied subject, an authentication-capable EKU, and enrolment rights for a broad group.
Other relay paths and protocol fallbacks may remain, and the enrolment endpoint itself is still exposed. Remove or harden the endpoint.
Effective write permissions on template objects and on the PKI container in Active Directory.