ADCS ESC8 exploit against HTTPS with empty SSL/TLS cert

[MinhPham123456789]

Hi all,

I came across a scenario where a CA has Web Enrollment

• HTTP disabled
• HTTPS enabled
• Channel Binding (EPA) is True
  However, that CA web server does not have a valid SSL/TLS cert (empty cert).

In that scenario, is the CA server still vulnerable to ESC8? It would be much appreciated if you can provide technical explanation for the answer too.

Thank you all