We have an internal CA server for our domain located at http://cert_srvr.local.domain/certsrv/certrqxt.asp. This server runs Microsoft Active Directory Certificate Services.
When I went to the site, I was able to use a CSR that I made on a linux computer to request an advanced certificate issued to the DNS name of our web proxy server. I used the following command to create the CSR:
openssl req -new -newkey rsa:2048 -keyout key.key -out csr.csr
I think this is a security risk because my non-admin account credentials were passed through via NTLMv2 to the internal CA's Certificate Services site when I logged into it... and I was able to create a certificate as if I were the proxy server (IssuedTo: proxy-server.local.domain) even though I'm not.
Since all workstations on our domain have the MS AD CS server's certificate in their trusted cert store, the cert I made could be used in a MITM attack by pretending my PC was actually the proxy server. This would have to be used in conjunction with a DNS spoofing or other type of attack to get clients to believe my computer was the proxy server, but it is still possible that the certificate could be misused for redirected SSL traffic to be decrypted by a MITM machine.
Does this sound right, or is there no real security risk here?