Certipy AD CS AuditorStep-by-step reference: audit lab certificate services with Certipy ESC attacks. Lab only.FAQ

What is Certipy?

Certipy is a free, open-source AD Certificate Services auditor by Oliver Lyak. It enumerates templates, flags ESC1–ESC8 misconfigurations, and automates the request, forge, and authenticate chain for proof.

Is using Certipy legal?

Certipy itself is legitimate auditing software. Abusing certificate services without explicit written permission is illegal. Practice only in isolated AD CS labs or signed engagements, and guard forged material as live credentials.

How do I install Certipy?

Run pipx install certipy-ad on Python 3.8 or newer. Verify with certipy --help and keep it on the dedicated lab VM.

What is ESC1?

A template that lets requesters choose any identity plus loose enrollment rights. Request a certificate as administrator, authenticate with it, and the domain falls. Fix with restricted enrollment and approval.

What is ESC8?

HTTP-based certificate enrollment that accepts relayed NTLM authentication. Coerce a lab machine to authenticate, relay it to the endpoint, and receive a certificate. Fix with HTTPS-only enrollment and EPA.

How do I find vulnerable templates?

Run certipy find with -vulnerable against the lab DC. It ranks templates by ESC number with per-template abuse notes.

What do I do with a forged certificate?

Authenticate with certipy auth to prove impact in the lab, document the chain, then wipe every PFX and output file when done.

Why is there no CA in my lab?

Plain Active Directory has no certificate services. Use GOAD, a dedicated AD CS lab, or install the CA role on an isolated lab server.

All tools · Sitemap · Games