Certighost exploits a fallback mechanism in certificate issuance to trick the certification authority into accepting identity data from an attacker-controlled host instead of a legitimate domain controller.