---
id: 3724
title: "Fixing ESC1 - Enrollee supplies subject and template allows client authentication"
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/fixing-esc1-enrollee-supplies-subject-and-template-allows-client-authentication/"
published_at: "2026-01-13 01:10"
tags: ["cloud", "active-directory", "hardening", "adcs", "certificate-template", "esc1"]
phying_url: "https://phying.com/item/3724"
lang: en
---

# Fixing ESC1 - Enrollee supplies subject and template allows client authentication

## Summary

ESC1 remediation: vulnerable ADCS templates let low-privileged users request certificates as other accounts, even domain admins; fixes include restricting enrolment or disabling supply-in-request.

## Intelligence Metadata

- **Sources:** projectblack.io
- **Published:** 2026-01-13 01:10
- **Original:** https://projectblack.io/blog/fixing-esc1-enrollee-supplies-subject-and-template-allows-client-authentication/
- **Phying News:** https://phying.com/item/3724