Eliminate ESC15 False Positives

[richardhicks]

Invoke-Locksmith2 results in numerous ESC15s for unpublished certificate templates. Is this by design?

Also, the suggested remediation states that CA Manager Approval should be enabled on these certificates. However, these are version 1 templates that do not support this feature.

[jakehildreth]

I prefer to list all templates that match the vulnerability regardless of enabled/disabled status, but I get how that could be confusing. I'll update the ESC15 definition to require Enabled = $true

Locksmith 2 does currently have a separate finding for enabled Schema v1 templates with this recommendation:

Fix # Schema v1 templates cannot be upgraded in-place.
# Supersede this template by creating a new schema v2 (or later) template with equivalent settings,
# then configure the old template to be superseded by the new one.
# See: https://www.gradenegger.eu/en/basics-replace-superseding-of-certificate-templates/

Revert # No automated revert. Template schema version cannot be changed via script.
# If you superseded this template, re-enable the old template and remove the superseding relationship.

This isn't quite accurate, but I would rather not automate the superseding process.

Do you think it makes sense to merge ESC15 and Schema V1?

[richardhicks]

For me, the confusing thing is the recommendation to enable CA manager approval on a v1 template, which isn't possible. You should definitely flag v1 templates, but only if they are published. v1 templates pose no problem as long as they aren't published. :)

[jakehildreth]

Got it! I'll make updates soon!

[jakehildreth]

Resolved in #91

Now ESC15 will only fire on Enabled v1 templates with Client Auth EKU. Risk is high!

SchemaV1 will only fire on Enabled v1 templates without Client Auth EKU. Risk is low!

Remediation for both is the same: supersede with a v2+ template.

<Baymax voice>: Are you satisfied with your care?

[richardhicks]

🤛 <Baymax voice>: Bah-a-la-la-la!