Skip to content

AD-ADCS-014: ESC11: CA does not require encryption for ICPR requests

medium high   Certificate services   MITRE ATT&CK T1649, T1557   Reads: CA registry probe

A CA does not require packet privacy on its RPC enrollment interface (IF_ENFORCEENCRYPTICERTREQUEST off), so coerced authentication can be relayed to it for a certificate.

Also known as: esc11

Why it matters

AD CS accepts certificate requests over RPC through the ICertPassage (MS-ICPR) interface. The CA's IF_ENFORCEENCRYPTICERTREQUEST flag controls whether that interface demands RPC_C_AUTHN_LEVEL_PKT_PRIVACY, where every packet is signed and encrypted. It is on by default but is sometimes turned off for legacy clients.

With it off, an attacker who can coerce a victim (for example a domain controller, through PetitPotam or PrinterBug) into authenticating to a host they control can relay that NTLM authentication to the CA's RPC endpoint and request a certificate as the victim. A certificate for a DC's machine account yields DCSync and domain compromise. It is the RPC counterpart of ESC8 (AD-ADCS-010), which relays over HTTP.

How ad-doctor detects it

ad-doctor reads CA\InterfaceFlags from the CA registry over \pipe\winreg and reports the CA when the IF_ENFORCEENCRYPTICERTREQUEST bit (0x200) is not set. ad-doctor does not send any ICPR request; the finding is read from the flag alone. When the CA holds requests for a manager, that is noted and the severity drops.

Attributes and probes read
  • CA\InterfaceFlags (IF_ENFORCEENCRYPTICERTREQUEST)
  • policy\RequestDisposition

Severity

High: NTLM authentication coerced from a privileged account, a domain controller for instance, can be relayed to the CA's RPC enrollment interface (MS-ICPR) and turned into a certificate for that account, which under strong mapping leads to DCSync. Drops to medium when the CA holds every request for a manager (RequestDisposition has REQDISP_PENDING), which adds a manual approval step but does not remove the exposure.

False positives and limits

  • Mitigated elsewhere. The relay still needs a coercion primitive and a machine that will authenticate. Enforcing SMB and LDAP signing, Extended Protection, and blocking coercion reduce the practical risk, but the flag is the control this check measures, so it is still reported until the flag is set.

Fix

  1. Require packet privacy on the CA and restart the service:

    certutil -config "<host>\<CA name>" -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST
net stop certsvc & net start certsvc

  2. Investigate why it was off: only very old clients need the lower level. Update or isolate them rather than leaving the interface open.

  3. Reduce coercion and relay generally: enforce SMB and LDAP signing and channel binding on domain controllers, and keep the CA host patched against coercion techniques.

Verify

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-ADCS-014

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-ADCS-014"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References

Microsoft and vendors

Specifications

Research

Tools

MITRE ATT&CK

New in the next release.