AD Certificate Services Hardening

A comprehensive guide for assessing and hardening Active Directory Certificate Services (AD CS) environments.

Quick Start

# Enumerate CAs and templates
certipy find -vulnerable -dc-only -u user@domain.local -p password -target dc.domain.local

# Check for vulnerable templates with Certify
Certify.exe find /vulnerable

# List all certificate templates
certutil -v -dstemplate

Certificate Fundamentals

Key Components

Critical Security Considerations

Subject Alternative Names (SANs) are crucial for servers with multiple domains. Secure issuance processes are vital to prevent attackers from manipulating SAN specifications for impersonation.

Template Version Matters:

• v1 templates (e.g., default WebServer) lack modern enforcement controls
• ESC15/EKUwu vulnerability: On v1 templates, requesters can embed Application Policies/EKUs in CSRs that override template EKUs
• Recommendation: Use v2/v3 templates, remove or supersede v1 defaults, tightly scope EKUs

AD CS Architecture

Certificate Authority Containers

CN=Certification Authorities          # Trusted root CA certificates
CN=Enrolment Services                 # Enterprise CAs and templates
CN=NTAuthCertificates                 # CA certificates for AD authentication
CN=AIA (Authority Information Access) # Chain validation certificates

NTAuthCertificates Location

CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=<domain>,DC=<com>

Enumeration & Assessment

Tools Overview

Certify.exe cas

Certify.exe find /vulnerable

certipy find -vulnerable

certipy req -web

certutil -TCAInfo

certutil -v -dstemplate

Enumeration Commands

# Enumerate trusted root CAs and Enterprise CAs
Certify.exe cas

# Identify vulnerable certificate templates
Certify.exe find /vulnerable

# Certipy enumeration (v4+)
certipy find -vulnerable -dc-only -u john@corp.local -p Passw0rd -target dc.corp.local

# Request certificate via web enrollment
certipy req -web -target ca.corp.local -template WebServer -upn john@corp.local -dns www.corp.local

# Native Windows enumeration
certutil.exe -TCAInfo
certutil -v -dstemplate

Certificate Request Methods

1. MS-WCCE - Windows Client Certificate Enrollment Protocol (DCOM)
2. MS-ICPR - ICertPassage Remote Protocol (named pipes/TCP)
3. Web Enrollment - Certificate Authority Web Enrollment role
4. CES/CEP - Certificate Enrollment Service
5. NDES - Network Device Enrollment Service (SCEP)
6. GUI - certmgr.msc or certlm.msc
7. CLI - certreq.exe or PowerShell Get-Certificate

ESC Vulnerabilities (Enterprise Security Certificates)

Critical Vulnerabilities Timeline

ESC Vulnerability Categories

Hardening Recommendations

Immediate Actions

1. Patch all systems

   • Apply May 2022 or later security updates
   • Install KB5014754 for strong certificate binding

2. Template hardening

   # Disable "Supply in the request" option
   # Remove Any Purpose / No EKU from templates
   # Require manager approval for sensitive templates
   

3. Enrollment controls

   • Restrict web enrollment (certsrv) to trusted networks
   • Require HTTPS + Extended Protection
   • Disable NTLM where possible

4. RPC enrollment encryption

   certutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST
   

Microsoft Strong Certificate Binding (KB5014754)

Microsoft's three-phase rollout:

1. Compatibility - Legacy behavior maintained
2. Audit - Event ID 39/41 for weak mappings
3. Enforcement - Full enforcement (automatic Feb 11, 2025)

Action items:

• Patch all DCs & AD CS servers
• Monitor Event ID 39/41 during Audit phase
• Re-issue client-auth certificates with SID extension
• Configure strong manual mappings before Feb 2025

Defender for Identity Integration

Deploy AD CS sensors to all AD CS servers for:

• Posture assessments (ESC1-ESC8, ESC11, ESC15)
• Real-time alerts:
  • "Domain-controller certificate issuance for a non-DC" (ESC8)
  • "Prevent Certificate Enrollment with arbitrary Application Policies" (ESC15)

Certificate Authentication

Kerberos PKINIT Process

1. User requests TGT signed with certificate private key
2. Domain controller validates:
   • Certificate validity
   • Certificate path
   • Revocation status
   • Trusted source
   • Issuer in NTAUTH certificate store
3. TGT issued on successful validation

Schannel Authentication

• TLS/SSL handshake with certificate presentation
• Certificate-to-account mapping via:
  • Kerberos S4U2Self
  • Subject Alternative Name (SAN)

Scripts

See the

scripts/

• enumerate-cs.py

  - AD CS enumeration helper

• check-esc-vulns.py

  - ESC vulnerability checker

• hardening-checklist.sh

  - Hardening validation script

References

• TrustedSec EKUwu Analysis
• Microsoft Defender for Identity
• SpecterOps Certified Pre-Owned
• Microsoft KB5014754
• Eventus Security Advisory