Chase fallback is an AD CS lookup behavior where a certificate authority follows requester-supplied attributes to resolve identity information from another host. If the target is not validated, an attacker can steer the CA toward a rogue system. The risk comes from trusting unverified lookup targets during enrollment.
Expanded Definition
Chase fallback is a certificate enrollment lookup behavior in Active Directory Certificate Services where the certificate authority follows requester-supplied attributes to locate identity data on another host. In NHI security, the important distinction is that the CA is not merely reading a directory value. It is being directed to a lookup target, which can turn identity resolution into a trust decision. That makes chase fallback materially different from ordinary attribute retrieval and from well-scoped certificate subject mapping. Guidance varies by platform documentation, but the security principle is consistent: any requester-influenced lookup path must be treated as untrusted until it is validated against a known directory boundary or an approved identity source. For broader identity assurance context, compare this behavior with the assurance and proofing concepts in NIST SP 800-63 Digital Identity Guidelines. The most common misapplication is allowing enrollment logic to chase arbitrary hosts when the attribute source has not been constrained to a validated directory.
Because the lookup happens during enrollment, the blast radius can extend from a single certificate request to downstream authentication, automation, and workload trust decisions.
Examples and Use Cases
Implementing chase fallback defensively often adds validation overhead and can break legacy enrollment flows, so teams must weigh compatibility against the risk of trusting attacker-directed lookups.
- A certificate authority resolves a requester attribute by querying a second host that the requester referenced in the enrollment data, which creates an opportunity to redirect identity resolution to a rogue system.
- An AD CS deployment accepts fallback lookups for missing identity fields, but the lookup target is not restricted to a trusted domain controller or approved identity store.
- A red team demonstrates that malicious enrollment attributes can influence certificate subject resolution, exposing a path from weak validation to certificate issuance abuse.
- Security teams compare enrollment policy behavior against the operational guidance in the Ultimate Guide to NHIs, which highlights how fragile identity governance becomes when lookup and trust are mixed.
- Control owners pair enrollment hardening with the access control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls to reduce unsafe identity resolution paths.
Why It Matters in NHI Security
Chase fallback matters because certificate authorities are high-trust decision points for non-human identity issuance. If a CA can be steered toward an unverified host, the resulting certificate can inherit legitimacy that was never actually earned. That is a governance failure, not just a configuration flaw. In NHI programs, this is especially dangerous because service identities often automate production access, and compromised enrollment paths can become reusable footholds across workloads, pipelines, and internal services. NHIMG notes that Ultimate Guide to NHIs reports 97% of NHIs carry excessive privileges, which means a single misissued certificate can quickly become an enterprise-wide privilege problem. The right defensive posture is to constrain lookup targets, validate identity sources explicitly, and monitor enrollment behavior as part of certificate governance. This also aligns with the control intent in NIST SP 800-63 Digital Identity Guidelines, where identity proofing and binding should not rely on untrusted assertions. Organisations typically encounter the consequences only after a certificate is abused in an authentication event, at which point chase fallback becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Chase fallback creates unsafe trust in requester-influenced identity lookup paths. |
| NIST SP 800-63 | AAL2 | Identity assurance guidance helps frame when certificate-linked identities can be trusted. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access depends on preventing untrusted identity resolution during enrollment. |
Constrain certificate enrollment lookups to validated sources and reject requester-directed target resolution.
