• Updated

This article applies to BHCE and BHE


The principal has the "Manage Certificates", also known as "CA Officer", permission on the Enterprise CA. This permission allows the principal to force the CA to issue certificates that the CA had previously denied issuance of.



Abuse Info

This relationship alone is not enough to perform a privilege escalation or impersonation primitive. This relationship may contribute to other relationships and attributes, from which an escalation opportunity may emerge.


Opsec Considerations

When an attacker abuses a privilege escalation or impersonation primitive that relies on this relationship, it will necessarily result in the issuance of a certificate. A copy of the issued certificate will be saved on the host that issued the certificate.



This edge is related to the following MITRE ATT&CK tactic and techniques:


Abuse and Opsec references