2 writeup(s) tagged certificate-abuse.
Full HackTheBox write-up for the AirTouch Fortress
Boot to Root Write-up