Certipy for Active Directory Certificate Security

Certipy is a Python-based security assessment tool for identifying and testing misconfigurations in Active Directory Certificate Services (AD CS). AD CS provides certificate-based identity and authentication capabilities in Windows domain environments. Incorrect certificate template settings or excessive enrollment permissions can allow low-privileged users to obtain certificates that may be used to impersonate other accounts.

Inspired by the C# tool Certify, Certipy helps security teams assess certificate authorities, enumerate certificate templates, request certificates, and evaluate authentication risks. It is useful for authorized penetration tests, Active Directory security audits, and defensive validation.

Key Features of Certipy

• Certificate template discovery: Enumerates available templates and their enrollment settings.
• Misconfiguration detection: Highlights risky permissions, subject-name settings, and authentication-related extended key usages.
• Certificate requests: Tests whether an account can request a certificate from an available template.
• Certificate-based authentication: Evaluates certificate authentication paths in an authorized test environment.
• Automated assessment: Combines discovery and testing steps to help assess potential privilege-escalation paths.

Installation

Use a supported Python environment and follow the installation instructions for the specific Certipy version you intend to assess. The original version documented a source-based installation method:

python3 setup.py install

Certipy versions and package layouts can differ. Consult the project’s official documentation before installing, particularly if you are using a newer release.

Official project repository: Certipy on GitHub.

Command-Line Help

Display the available options and actions with:

certipy -h

The original command interface accepts a domain target and an action. Its main actions include:

• find – Enumerates certificate authorities and certificate templates.
• req – Requests a certificate from a certificate authority.
• auth – Tests authentication using a certificate.
• auto – Automates a sequence of certificate-template assessment steps.

Common connection and authentication options include:

• -debug – Enables debug output.
• -dc-ip – Specifies the domain controller’s IP address.
• -target-ip – Specifies the target system’s IP address when name resolution is unavailable.
• -nameserver – Sets the DNS server used for name resolution.
• -dns-tcp – Uses TCP for DNS queries.
• -k – Attempts Kerberos authentication using available credential-cache information.
• -no-pass – Prevents a password prompt in supported authentication workflows.
• -hashes – Supplies NTLM hashes in the documented LMHASH:NTHASH format.

Check the help output for your installed release because argument names and behavior may change between versions.

Finding Risky Certificate Templates

The find action helps identify certificate authorities, template configurations, enrollment permissions, and potentially dangerous settings. In an authorized lab, a focused scan can limit results to templates that Certipy identifies as vulnerable:

certipy find -vulnerable

Supply the appropriate target and authentication options for your environment, as described in the installed version’s help. Review the results for conditions such as:

• Enrollment rights granted to broad groups, including Authenticated Users.
• Templates that allow the requester to supply a subject or subject alternative name.
• Client Authentication or other authentication-capable extended key usages.
• Missing or insufficient approval requirements.
• Permissions that allow untrusted users to modify template settings or certificate authority configuration.

A single setting does not always prove that a template is exploitable. Assess the complete combination of template flags, enrollment rights, certificate authority configuration, and domain controls before assigning severity.

Enumerating All Templates

To review the broader certificate environment rather than only templates flagged as vulnerable, use the find action without the vulnerability filter:

certipy find

The output can include certificate authority names, validity periods, enrollment permissions, extended key usages, and object-control permissions. Use these details to prioritize risky configurations and document the evidence for remediation.

Using Certipy for Defensive Assessments

Run assessments only against domains and certificate services you are authorized to test. Begin with read-only enumeration, preserve relevant output, and validate findings with the Active Directory and PKI administrators. Avoid automated certificate requests or authentication tests against production accounts unless they are explicitly approved.

Administrators should review certificate template enrollment permissions, remove unnecessary subject-supply capabilities, restrict authentication-capable templates to appropriate groups, and audit changes to certificate authorities and templates. For related reconnaissance techniques, see our guide to website reconnaissance tools and techniques.