Identity and Privileged Access Security
Certificate Infrastructure and AD CS
We review your Active Directory Certificate Services (AD CS) infrastructure. We identify settings that allow a regular user to obtain a certificate in an administrator's name.
What it is
AD CS issues certificates to users, computers and services within the organization. These certificates can be used to sign in instead of a password. A misconfigured template can allow a user to obtain a certificate in someone else's name. Such a certificate remains valid for its lifetime, even if the target account's password changes.
Scope
- Certificate templates and enrollment permissions
- Settings and administrators of certificate authority (CA) servers
- Web enrollment interfaces and authentication settings
- Certificate mapping settings on domain controllers
- Protection of CA private keys and HSM usage
- Certificate revocation and tracking of expiring certificates
The need
When organizations need it
- When AD CS was set up years ago and it is unclear who published the templates or why.
- When a penetration test reports a privilege escalation finding via AD CS.
- Before expanding certificate use to wireless, VPN or smart card sign-in.
Method
How we work
-
Inventory
We list certificate authorities, templates and enrollment permissions using a standard user account.
-
Configuration analysis
We review templates and CA settings against misconfiguration classes known from public research.
-
Controlled validation
With your approval, we verify critical findings using a test account and keep records.
-
Order of fixes
We determine the order for fixing template permissions and CA settings without disrupting systems using certificates.
Outcome
What you have at the end
You know who can obtain a certificate in whose name within your certificate infrastructure. Risky templates are listed with the systems that use them and prioritized for fixing.
Frequently asked questions
We think we do not use AD CS. Should we still check?
Yes. AD CS is sometimes added during application installation and then forgotten. The inventory step also shows if there is a certificate authority in the environment.
What does disabling a problematic template affect?
Systems that obtain certificates from that template cannot renew them. Therefore, systems using the template are identified first, then permissions are restricted.
Identity and Privileged Access Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting