---
id: 3720
title: "Fixing ESC8 - Web Enrollment is enabled over HTTP and HTTPS, and Channel Binding is disabled"
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/fixing-esc8-web-enrollment-is-enabled-over-http-and-https-and-channel-binding-is-disabled/"
published_at: "2026-04-06 10:59"
tags: ["ai-security", "active-directory", "hardening", "adcs", "esc8", "ntlm-relay"]
phying_url: "https://phying.com/item/3720"
lang: en
---

# Fixing ESC8 - Web Enrollment is enabled over HTTP and HTTPS, and Channel Binding is disabled

## Summary

Fixing ESC8: when ADCS web enrolment is reachable over HTTP or lacks Channel Binding/EPA, a relay attack can obtain a domain controller certificate. The fix is requiring EPA and SSL in IIS.

## Intelligence Metadata

- **Sources:** projectblack.io
- **Published:** 2026-04-06 10:59
- **Original:** https://projectblack.io/blog/fixing-esc8-web-enrollment-is-enabled-over-http-and-https-and-channel-binding-is-disabled/
- **Phying News:** https://phying.com/item/3720