Active Directory Certificate Services (AD CS) is Microsoft's public-key infrastructure for a Windows domain — it issues the certificates used for smart-card logon, encryption, code signing, and authentication. It is also, since the 2021 "Certified Pre-Owned" research, one of the most productive attack surfaces in AD. The reason is simple and severe: a certificate can be used to authenticate via Kerberos, so a misconfiguration that lets you obtain a certificate as someone else is a misconfiguration that lets you become them.
The pieces
| Component | Role |
|---|---|
| Certificate Authority (CA) | The server that issues certificates. An Enterprise CA is integrated with AD and trusted domain-wide |
| Certificate template | A blueprint defining who can enrol, what the certificate can be used for, and how the subject is determined |
| Enrollment | The act of requesting a certificate against a template; can be via RPC, the web endpoint, or DCOM |
| EKU (Extended Key Usage) | What the certificate is allowed to do — the critical one is Client Authentication |
| SAN (Subject Alternative Name) | Who the certificate is for. If you can set this freely, you can be anyone |
Why a certificate equals authentication
Kerberos supports PKINIT — public-key authentication for the initial AS exchange. Instead of proving you know a password, you prove you hold the private key of a certificate whose subject the KDC trusts. So a certificate with the Client Authentication EKU, issued for a given identity, can be exchanged for a TGT as that identity.
Two consequences make certificates worse than passwords. First, obtaining a certificate for a user does not require or reveal their password. Second, a certificate's validity is often measured in years, and a certificate is not invalidated by a password reset — so it is persistence that survives the usual remediation. Recovering a machine's or user's certificate is frequently more durable than stealing its hash.
The ESC classes
The misconfigurations are catalogued as ESC1 through ESC16 (and growing). You do not need to memorise all of them; you need to understand the shape of the common ones, because Certipy finds and exploits them for you. The highest-frequency ones:
| ESC | The misconfiguration |
|---|---|
| ESC1 | A template allows the enrollee to specify the SAN, has a client-auth EKU, and allows low-priv enrolment. Request a cert "for" Administrator → authenticate as Administrator |
| ESC2 | A template has the Any Purpose EKU (or no EKU restriction), so an issued cert can be used for authentication regardless of intent |
| ESC3 | An Enrollment Agent template lets you request certs on behalf of other users |
| ESC4 | You have write access to a template object — reconfigure it into an ESC1 and then abuse it |
| ESC6 | The CA has the EDITF_ATTRIBUTESUBJECTALTNAME2 flag set, letting any request specify a SAN regardless of the template |
| ESC7 | You have dangerous rights over the CA itself (ManageCA / ManageCertificates) |
| ESC8 | The CA's web enrolment endpoint accepts NTLM without EPA — relay a coerced machine account to it and get a cert for that machine |
ESC1 — the canonical example
ESC1 is worth walking through because it captures the whole idea. The template
allows a normal user to enrol, its EKU permits client authentication, and — the
fatal flag — ENROLLEE_SUPPLIES_SUBJECT lets the requester name the
subject. So you request a certificate and simply say the subject is
administrator@corp.local. The CA issues it. You then use it for PKINIT
and receive Administrator's TGT. Every other ESC is a variation on that same theme:
some property of a template or the CA lets a low-privileged requester obtain a
certificate that authenticates as someone more privileged.
ESC8 — the relay path
ESC8 is the one that connects to coercion
and relay. The CA's web enrolment page (/certsrv) accepts NTLM
authentication, and if Extended Protection for Authentication is not enforced, that
NTLM can be relayed. Coerce a domain controller to authenticate, relay it to the CA
web endpoint, request a certificate for the DC, and turn that into the DC's TGT —
domain compromise from a coercion primitive and a missing EPA setting. Certipy finds
and exploits every ESC class, and the command-level walkthroughs live in the
Vulns & Misconfigs section under ADCS ESC Abuse
(and, for the relay itself, Coercion & NTLM Relay).
Shadow Credentials — the AD CS-adjacent attack
Even without a vulnerable template, AD CS's PKINIT support enables the
Shadow Credentials attack. If you can write the
msDS-KeyCredentialLink attribute of an account (an
ACL right), you add your own key pair to it
and authenticate as that account via PKINIT — recovering its NT hash without touching
its password. pyWhisker writes the attribute; Certipy
does the PKINIT.
Detection and defence
| Control | Effect |
|---|---|
| Audit templates with Certipy/PSPKIAudit | Find the ESC conditions before an attacker does — this is the primary defence |
| Remove ENROLLEE_SUPPLIES_SUBJECT | Kills ESC1 where the SAN does not genuinely need to be enrollee-supplied |
| Enforce EPA on the CA web endpoint | Closes ESC8 |
| Restrict enrolment and manager rights | Least privilege on templates and the CA itself addresses ESC4 and ESC7 |
| Enable CA request logging / monitor issuance | A certificate issued for a privileged SAN to a low-priv requester is a strong signal |
| Require manager approval on sensitive templates | Adds a human gate that breaks automated abuse |
The takeaway
AD CS is dangerous because it mints authentication. A certificate is a password-independent, long-lived, reset-surviving credential, and PKINIT turns it straight into a Kerberos TGT. The ESC classes are all variations on one theme — get the CA to issue you a certificate for an identity you should not control — whether by supplying your own subject (ESC1/6), rewriting a template (ESC4), abusing the CA (ESC7), or relaying to the web endpoint (ESC8). Certipy is the tool that both finds and exploits them; run it early, because when AD CS is misconfigured it is often the shortest path to Domain Admin. See Kerberos for PKINIT and Coercion & NTLM Relay for the ESC8 chain.