Applies to BloodHound Enterprise and CE This permission allows the principal to force the CA to issue certificates that the CA had previously denied issuance of.

​
Abuse Info

This relationship alone is not enough to perform a privilege escalation or impersonation primitive. This relationship may contribute to other relationships and attributes, from which an escalation opportunity may emerge.

​
Opsec Considerations

When an attacker abuses a privilege escalation or impersonation primitive that relies on this relationship, it will necessarily result in the issuance of a certificate. A copy of the issued certificate will be saved on the host that issued the certificate.

​
References

This edge is related to the following MITRE ATT&CK tactic and techniques:

​
Abuse and Opsec references