Attackers use Certipy to assess and abuse Active Directory Certificate Services by finding certificate template and enrollment misconfigurations. They may request certificates that map to privileged identities or misuse delegation paths. Defenders should review template permissions, enrolment settings, and certificate mapping, and watch for unusual certificate requests or AD CS enumeration activity.
How Certipy turns AD CS misconfigurations into abuse paths
Certipy is useful to attackers because it automates discovery of Active Directory Certificate Services weaknesses that are often operational rather than obviously “broken.” The tool helps map templates, enrollment rights, certificate mapping rules, and delegation paths, then shows which combinations can be turned into usable certificates for higher privilege or broader access. It is especially effective where AD CS has grown complex over time.
That matters because the abuse path is usually not a single exploit, but a chain: enumerate the certificate authority, identify templates that allow risky enrollment or subject mapping, then request a certificate that the directory will trust as a privileged identity. When those settings are loose, the certificate becomes a durable authentication artifact rather than a one-time foothold.
Certipy is also used for assessment, not just abuse. A defender can use the same workflow to validate whether certificate templates are too permissive, whether enrollment is exposed to the wrong groups, and whether certificate-to-account mapping creates unintended trust relationships. For background on broader AD and certificate-service hardening, see Active Directory and Entra ID Hardening Guide.
What attackers look for first in AD CS
Attackers generally start by looking for templates and enrollment paths that let them obtain a certificate without the intended business approval process. The most useful findings are templates that can be enrolled by broad groups, templates that allow the requester to supply identity attributes, and certificate mapping settings that let the resulting certificate authenticate as a privileged user or service account.
They also look for delegation paths that make the certificate more valuable than a simple login artifact. If a certificate can be used for authentication, SSO-style access, or lateral movement into administrative paths, the attacker gains a reusable credential that may outlast a password reset unless the underlying certificate and mapping are revoked.
In practice, the signal is often in the directory configuration itself, not in malware-like behavior. That is why suspicious certificate request patterns, CA enumeration, and template probing are important detection points, especially when they come from hosts or accounts that do not normally administer PKI.
Certipy also fits the broader credential-access pattern seen in adversary tradecraft, where the objective is to turn a configuration weakness into an identity they can reuse. The MITRE ATT&CK Enterprise Matrix is useful for mapping that sequence from discovery through credential access and lateral movement.
How defenders reduce the value of Certipy activity
The best defensive response is to treat AD CS as an identity system, not just an infrastructure service. Review template permissions, who can enroll, whether subject or SAN supply is allowed, whether manager approval is required, and whether certificate mappings can bind a certificate to an account in ways the business did not intend. If those controls are broad, the tool becomes useful to an attacker very quickly.
Defenders should also make the certificate lifecycle operationally visible. That means knowing which templates exist, who can request them, which accounts are eligible, and which certificates have been issued recently. Unusual issuance volume, new requesters, or requests from systems outside normal PKI workflows deserve immediate review because they can indicate reconnaissance or active abuse.
If you are hardening for both attackers and auditors, focus on limiting the blast radius of any one template and on removing unnecessary delegation in certificate issuance. Where possible, align certificate enrollment and mapping with least privilege, and verify that privileged identities cannot be impersonated through a template that was originally created for convenience.
Risk and Threat Considerations
Certipy is dangerous in environments where AD CS has accumulated permissive templates, weak enrollment controls, or overly flexible mapping. In those cases, the tool can turn a configuration issue into authentication abuse, privilege escalation, and persistence without needing a traditional exploit chain.
Failure mechanism: An attacker enumerates AD CS, finds a template or enrollment path that permits abuse, requests a certificate that maps to a more privileged identity, and then uses that certificate to authenticate or move laterally as if they were the trusted account.
Impact: The result can be unauthorized access to administrative systems, durable persistence through certificate-based trust, and compromise that survives ordinary password-centric remediation unless the relevant certificates, mappings, and trust relationships are revoked.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1552 — Unsecured Credentials | Certipy abuse often turns directory misconfigurations into credential-like authentication artifacts. |
| Recommendation — Map AD CS abuse to credential-access detection and hunt for unusual certificate issuance and use. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate issuance and lifecycle control are central when certificates can be abused as authenticators. |
| AC-6 — Least Privilege | Risk arises when enrollment and mapping grant more access than the requester should have. | |
| Recommendation — Tighten certificate lifecycle controls and revoke or replace abused authenticators quickly. Restrict enrollment and mapping paths to the minimum privilege needed for each template. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Certipy abuse depends on excessive access to enrollment, mapping, or certificate trust paths. |
| Recommendation — Review and remove unnecessary access to certificate enrollment and administrative paths. | ||
Practitioner Guidance
What to verify: Confirm which templates allow broad enrollment, whether requester-supplied identity fields are permitted, and whether any certificate mapping can impersonate privileged or service identities. The key question is not whether AD CS exists, but whether any template can be turned into a trust shortcut.
Decision rule: If a certificate can authenticate to a privileged path, treat it like a credential exposure problem, not just a PKI hygiene issue. Prioritise template restriction and revocation planning before you assume the environment is safe because no password was stolen.
Practitioner takeaway: Certipy becomes dangerous when certificate services are configured as convenience infrastructure rather than controlled identity infrastructure, because the attacker’s prize is a trusted authentication artifact, not merely a misconfiguration.