An attacker may perform several attacks that rely on the existence of a root CA, such as ESC1. This edge
alone is not enough to escalate rights or impersonate other principals. This edge may contribute to other
edges and attributes, from which an escalation opportunity may emerge.
When the affected certificate authority issues the certificate to the attacker, it will retain a local copy of that certificate in its issued certificates store. Defenders may analyze those issued certificates to identify illegitimately issued certificates and identify the principal that requested the certificate, as well as the target identity the attacker is attempting to impersonate.
