Blessed Certifried, Who Got Certified as a Domain Controller

Patron of Active Directory Certificate Services, computer accounts anyone can create, and borrowed DNS names.

Life

On 10 May 2022, patch day, Oliver Lyak described Certifried (CVE-2022-26923). Any domain user could create a computer account, change its DNS name to that of a domain controller and ask AD CS for a certificate: the authority issued it without asking questions. With that certificate you could pose as the controller itself, and from there the whole domain was a short step away.

Prayer

O Blessed Certifried, who had a stranger's identity stamped as your own, let our certificate authorities ask for papers. Amen.

How to celebrate

Celebrated by installing the May 2022 updates and setting to zero the number of computers each user may add to the domain.

Easy certificate, lost domain.