ADCS ESC17

ESC17 is an AD CS template misconfiguration: an eligible enrollee can supply a DNS identity on a certificate whose EKU permits TLS server authentication (or equivalent unrestricted purpose). If the template is published and effective issuance gates do not block the request, the issued certificate can name a different service FQDN. The certificate alone does not redirect traffic or provide client authentication/PKINIT. Public WSUS examples use the certificate for HTTPS server impersonation and then either relay client NTLM authentication or manipulate update delivery; the downstream effect depends on the selected service path and target privileges.