Difference between revisions of "Enterprise Certificate Authority"
From MgmtWiki
(→Problems) |
(→Solutions) |
||
| Line 14: | Line 14: | ||
==Solutions== | ==Solutions== | ||
| − | + | In general, the solutions are to more securely tie the [[MTLS]] authentication process to the principal ID that is used to grant access to specific enterprise resources. | |
* [https://social.technet.microsoft.com/wiki/contents/articles/53249.active-directory-certificate-services-enterprise-ca-architecture.aspx Active Directory Certificate Services: Enterprise CA Architecture] | * [https://social.technet.microsoft.com/wiki/contents/articles/53249.active-directory-certificate-services-enterprise-ca-architecture.aspx Active Directory Certificate Services: Enterprise CA Architecture] | ||
Revision as of 15:57, 8 February 2023
Full Title or Meme
Any Certificate Authority that is designed to apply to people, natural or otherwise, that are known to the Enterprise.
Context
- Typically, an Enterprise Certificate Authority operates via Client Certificates that are issued to a digital Identifier that is issued to an Entity that has some means to control access to a protected Private Key that is used for Authentication.
- The most common form of Authentication is via Client Certificates that bind the Entity Identifier with a Client Certificate that is used in a TCP connection using Mutual Authentication to carry the proof of possession, not only of the key of the server, but also of the key of the Client.
- The most common form of Mutual Authentication uses MTLS or mutual transportation layer security.
Problems
In general, the problems are created by a mismatch between the MTLS authentication result and the identity of the principle in the enterprise network. There have been multiple vulnerabilities reported to the US Government the top three in 2022 are for Microsoft AD.
- CVE-2022-34691 An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow elevation of privilege to System.
- CVE-2022-26931 Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.
- CVE-2022-26923 A system is vulnerable only if both the Active Directory Certificate Services role and the Active Directory Domain Services role are installed on a server in the network. Note that they would not necessarily need to be on the same server.
Solutions
In general, the solutions are to more securely tie the MTLS authentication process to the principal ID that is used to grant access to specific enterprise resources.
