Skip to main content
AD Academy
Back to all events
4886Security (CA)Security & attacksWARN

Certificate Services received a certificate request

What it means

Someone requested a certificate from the CA server (AD CS). Normal by itself — but this is where ESC1 starts: a request carrying another user's name (SAN).

First steps

  1. 1It is logged on the CA server — make sure auditing is enabled there.
  2. 2Compare the Requester with the name in the certificate (SAN).
  3. 3Requests on a vulnerable template from a normal account are suspicious.

This reference is a starting point for investigation, not a replacement for your organisation's security policy.