{"id":8730,"date":"2025-04-07T06:08:00","date_gmt":"2025-04-07T06:08:00","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=8730"},"modified":"2025-04-07T06:08:01","modified_gmt":"2025-04-07T06:08:01","slug":"prevent-users-to-request-a-certificate-valid-for-arbitrary-users-based-on-the-certificate-template-esc1","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/prevent-users-to-request-a-certificate-valid-for-arbitrary-users-based-on-the-certificate-template-esc1","title":{"rendered":"Prevent users to request a certificate valid for arbitrary users based on the certificate template (ESC1)"},"content":{"rendered":"\n

We use Radius and NPS for Authentication , we had the below Defender for Identity show up <\/p>\n\n\n\n

Prevent users to request a certificate valid for arbitrary users based on the certificate template (ESC1)<\/strong><\/p>\n\n\n\n

Resolutions were : <\/p>\n\n\n\n

Identify the vulnerable certificate template. Perform at least one of the following possible remediations:
1. Disable the \u201cSupply in the request\u201d configuration.
2. Remove EKU\u2019s enabling user authentication (e.g Client Authentication).
3.Remove overly permissive enrollment permissions, which allows any user to enroll certificate based on that certificate template.
4.Enable \u201cCA certificate manager approval\u201d requirement.<\/p>\n\n\n\n

We changed the below <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

2) We can’t do this needed for Wifi Auth<\/p>\n\n\n\n

3) Can’t do this Users need to enroll<\/p>\n\n\n\n

4) Can’t do this don’t want manual approval <\/p>\n","protected":false},"excerpt":{"rendered":"

We use Radius and NPS for Authentication , we had the below Defender for Identity show up Prevent users to request a certificate valid for arbitrary users […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-8730","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t