PKI · ADCS · Identity · Zero Trust

Blog

Technical articles on PKI security, ADCS attack paths, vulnerability intelligence, identity architecture, and Zero Trust — written for practitioners.

Latest

ADCSJune 16, 20268 min read

ESC8 NTLM Relay and ADCS Web Enrollment: Enterprise Exposure, Detection, and Mitigation

ESC8 is a documented ADCS exposure pattern involving NTLM relay to HTTP-based certificate enrollment endpoints. We explain the exposure conditions, detection opportunities, and the configuration changes that eliminate the risk.

ADCSESC8NTLM RelayWeb Enrollment

Read article

PKIJune 12, 20266 min read

Microsoft Announces Mandatory CA Enforcement for Azure AD Certificate-Based Auth

Starting August 2026, Azure AD will enforce strict CA binding for certificate-based authentication. We explain what changes, which configurations break, and how to audit your tenant before the deadline.

PKIAzure ADCBAMicrosoft

Read

VulnerabilitiesJune 10, 202610 min read

ADCS ESC4: Certificate Template Write Privilege Escalation — Detection and Remediation

ESC4 allows low-privileged users with Write permissions on certificate templates to modify template attributes and introduce ESC1 conditions, enabling full domain compromise. This is a configuration vulnerability — no CVE required. Here is how to find and fix it.

VulnerabilitiesADCSESC4Privilege Escalation

Read

IdentityJune 8, 202612 min read

Certificate-Based Authentication vs. Password: Why PKI Wins for Privileged Access

A technical comparison of password-based and certificate-based authentication for privileged accounts in Active Directory. Covers Kerberos PKINIT, smart card enforcement, and why certificates are harder to relay, spray, or phish.

IdentityPKIAuthenticationPrivileged Access

Read

Zero TrustJune 5, 20269 min read

PKI as a Zero Trust Primitive: How Certificate Identity Anchors Device Trust

Zero Trust architectures require strong device identity. We examine how enterprise PKI — specifically ADCS-issued machine certificates — serves as the cryptographic foundation for device trust in Microsoft and hybrid environments.

Zero TrustPKIDevice IdentityADCS

Read

ADCSJune 3, 202614 min read

ESC1 Through ESC13: A Practical Remediation Roadmap for Enterprise ADCS

A structured walkthrough of all known ADCS ESC attack paths, prioritized by exploitability and blast radius. Includes detection queries, template hardening steps, and CA configuration guidance for each path.

ADCSESC PathsRemediationHardening

Read

Incident ResponseMay 28, 202611 min read

When Your CA Is Compromised: Containment, Revocation, and Recovery

A step-by-step incident response guide for CA compromise scenarios. Covers immediate containment actions, emergency CRL publication, rogue certificate identification, and the decision framework for CA rebuild vs. recovery.

Incident ResponsePKICA CompromiseRecovery

Read

IdentityMay 18, 20268 min read

Hybrid Identity and PKI: Syncing On-Premises CA Trust to Azure AD

How to extend your on-premises PKI trust to Azure AD for hybrid certificate-based authentication. Covers trusted CA upload, CRL accessibility requirements, and common sync failures that break cloud auth.

IdentityHybridAzure ADPKI

Read

Zero TrustMay 14, 20266 min read

OCSP Stapling and CRL Caching: Why Your Revocation Infrastructure Matters for Zero Trust

Revocation checking is often the weakest link in Zero Trust certificate validation. We examine OCSP stapling, CRL caching behavior across Windows clients, and how to design revocation infrastructure that actually works under load.

Zero TrustOCSPCRLRevocation

Read

PKIMay 9, 202616 min read

Building an Offline Root CA: The Complete Enterprise Procedure

A detailed operational guide for building, configuring, and securing an offline Root CA. Covers hardware selection, OS hardening, key ceremony procedures, CRL publication, and long-term storage. Includes a printable checklist.

PKIRoot CAOffline CAHardening

Read

ADCSMay 5, 20265 min read

Detecting ADCS Abuse with Windows Event IDs: A Blue Team Reference

A concise reference mapping ADCS attack techniques to the Windows Event IDs they generate. Covers certificate request events, template modification, CA configuration changes, and enrollment agent abuse — with SIEM query templates.

ADCSDetectionBlue TeamEvent IDs

Read

IdentityApril 28, 202615 min read

Kerberos PKINIT: Certificate-Based Auth in Active Directory

How Kerberos PKINIT works, how to configure it, and how to validate your deployment. Includes common failure modes, revocation checking behavior, and hybrid Azure AD CBA considerations.

IdentityPKIKerberosPKINIT

Read

Showing 12 of 27 articles

Get articles in your inbox

Weekly PKI and ADCS security intelligence — new articles, CISA KEV updates, and Patch Tuesday coverage.

Subscribe free

Advisory Services

Need a hands-on ADCS assessment? Our ESC1–ESC13 health check delivers a prioritized remediation roadmap.

View services