Blessed Zombie Certificate, Who Survives Revocation

Patron of corporate PKIs, revocation lists nobody checks, and admins who thought revoking was enough.

Life

On 7 October 2026 Jake Hildreth of Semperis described an "even creepier" persistence trick for Active Directory Certificate Services. An attacker who is already an admin strips the revocation-list pointer from issued certificates and talks the domain controllers into ignoring unknown status: certificates born this way keep working for PKINIT logon even after revocation, which no verifier can find any more. Dead to the registry, very much alive to Kerberos.

Prayer

O Blessed Zombie Certificate, who walks among the living without a revocation list, let our domain controllers say no when in doubt. Amen.

How to celebrate

Celebrated by emptying DisableExtensionList on the CAs, removing UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors from the domain controllers and replacing every certificate issued meanwhile, because revoking them is not enough.

The walking dead don't read revocation lists.