Conditional: validate an AD CS enrollment-to-authentication path

Needs: Effective enrollment/template/CA rights and the exact vulnerable settings; issuance requirements, identity mapping and authentication route must all permit the path

Package names vary

Prerequisite: reachable CA/DC and a valid domain identity. Decisive output: a CA/template whose enabled state, enrollment rights and configuration satisfy a specific ESC path.

# Package names vary
command -v certipy-ad || command -v certipy
certipy-ad find -u 'USER@DOMAIN' -p 'PASSWORD' -dc-ip DC_IP \
  -enabled -vulnerable -stdout

Generic request after validating a specific template

An ESC label is a candidate classification. Manually validate the properties and the controlled identity's effective rights.

# Generic request after validating a specific template
certipy-ad req -u 'USER@DOMAIN' -p 'PASSWORD' -dc-ip DC_IP \
  -target DC_HOST -ca CA_NAME -template TEMPLATE

Shell commands

An alternate UPN/SID request is appropriate only when the validated template permits it and the lab explicitly authorizes impersonation testing:

# Baseline
certipy-ad req -u 'USER@DOMAIN' -p 'PASSWORD' -dc-ip DC_IP \
  -target DC_HOST -ca CA_NAME -template TEMPLATE \
  -upn 'TEST_USER@DOMAIN' -sid 'TEST_USER_SID'

# Baseline
certipy-ad auth -pfx CERTIFICATE.pfx -dc-ip DC_IP

Before any authorized template change, save configuration

Treat PFX files, tickets and returned hashes as credentials. Verify certificate subject/SID, validity and intended identity. A successful issuance is not the same as successful PKINIT authentication.

Before any authorized template change, save configuration:

# Before any authorized template change, save configuration
certipy-ad template -u 'USER@DOMAIN' -p 'PASSWORD' -dc-ip DC_IP \
  -template TEMPLATE -save-configuration template-backup.json

Template writes alter Active Directory configuration and may affect many principals. Use only an explicitly authorized disposable lab path, inspect certipy-ad template -h for the installed version, and restore the saved configuration after the demonstration.

Verify → Verify issuance, matching private key, mapped account and a successful authentication effect; preserve and restore template changes.

If it fails → Denied enrollment, approval, mapping hardening or missing key material needs a different conditional route, not a renamed certificate tool. More detail ↓

If → then

A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
A valid ticket/cache or a long-term key that can request a TGT → Inventory, convert and import tickets in the correct logon context
Needs: Matching client/realm/service, valid lifetime, compatible format and available KDC/service routes; ticket import affects a specific context
An ACL/graph edge names GenericAll, GenericWrite, WriteDacl, WriteOwner or an extended/property right → Validate effective directory-object control
Needs: Effective trustee membership, target object/type, inheritance/deny behavior and the exact permitted operation

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Conditional: validate an AD CS enrollment-to-authentication path

USE WHEN: A CA/template configuration exposes a plausible certificate identity transition
STARTING ACCESS: A domain identity, appropriate host privilege, or a validated effective directory-object right
RESULT: An issued certificate/private-key capability that authenticates as the intended identity

Recognize the clue

Enumerate the CA and enabled templates with the known directory identity, then read rights and settings rather than acting on an ESC label.

certipy find -u 'USER@DOMAIN' -p 'PASSWORD' -dc-ip DC_IP -enabled

SYNTHETIC EXAMPLE OUTPUT

Template: TEMPLATE_NAME
Client Authentication: enabled
Subject control: candidate setting
Enrollment rights: GROUP
Approval/identity mapping: inspect

Means: The conjunction of purpose, subject control and effective enrollment rights is a candidate; issuance and identity mapping are separate gates.

Confirm: Check exact template/CA rights/settings, approval/signatures, required key, current mapping and authenticatable identity.

After validation: Issuance and intended account authentication are verified: use the certificate capability.
Ruled out in this context: Approval, denied enrollment or hardened mapping prevents the proposed transition: reject that route.
Still inconclusive: An ESC scanner label without the full effective configuration remains unconfirmed.

Troubleshooting: Denied enrollment, approval, mapping hardening or missing key material needs a different conditional route, not a renamed certificate tool.

Prerequisite: reachable CA/DC and a valid domain identity. Decisive output: a CA/template whose enabled state, enrollment rights and configuration satisfy a specific ESC path.

Package names vary:

Review:

CA name and host;
template name and whether it is enabled/published;
who can enroll;
client-authentication EKUs/purpose;
subject/SAN supply controls;
manager approval/signature requirements;
template owner and modification rights;
web enrollment/relay-related configuration where relevant.

An ESC label is a candidate classification. Manually validate the properties and the controlled identity's effective rights.

Generic request after validating a specific template:

An alternate UPN/SID request is appropriate only when the validated template permits it and the lab explicitly authorizes impersonation testing:

Treat PFX files, tickets and returned hashes as credentials. Verify certificate subject/SID, validity and intended identity. A successful issuance is not the same as successful PKINIT authentication.

Before any authorized template change, save configuration:

Template writes alter Active Directory configuration and may affect many principals. Use only an explicitly authorized disposable lab path, inspect certipy-ad template -h for the installed version, and restore the saved configuration after the demonstration.

Why it works

A scanner's ESC label summarizes conditions; it does not guarantee issuance or modern account mapping. Template write is an intermediate modification requiring preservation and validation of all necessary properties.

Worked example · hypothetical

Observation: a template is labelled vulnerable. Test: inspect enrollment rights, approval, subject control and mapping requirements. Illustrative output: manager approval blocks issuance. Interpretation: the scanner candidate is not an immediately usable identity transition.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗