> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/active-directory-abuse-kerberos-delegation-and-ad-cs/ad-cs-fundamentals.md).

# AD CS Fundamentals

Active Directory Certificate Services, or AD CS, is Microsoft's PKI platform.

It issues certificates for authentication, encryption, signing, smart cards, web services, and other enterprise uses. In the wrong state, it also gives attackers a way to mint trusted identity.

### Why AD CS matters

Passwords are not the only way to authenticate in Active Directory.

If a certificate can be used for domain authentication, control of the right template or enrollment path can become control of another identity.

### What a certificate does

A certificate binds identity to a public key.

The subject, subject alternative names, validity period, key usage, and issuer signature all help define how that certificate can be used.

In an AD environment, the most important question is often simple: can this certificate authenticate to the domain?

### How issuance works

The normal flow looks like this:

1. A client generates a key pair.
2. The client submits a certificate signing request.
3. The CA evaluates template rules and permissions.
4. The CA issues or denies the certificate.

That evaluation step is where most abuse paths begin.

### Certificate templates

A certificate template is the blueprint for issuance.

It defines who can enroll, what fields the requester may supply, which EKUs are present, whether approval is required, and how the subject is built.

The most dangerous templates are not always exotic. Often, the problem is a default-looking template with loose enrollment rights and one risky flag.

### EKUs and authentication

Extended Key Usages define what the certificate is allowed to do.

For AD abuse, authentication-capable EKUs matter most. If a certificate can authenticate a user or machine, then enrollment control becomes identity control.

### Subject Alternative Name

The Subject Alternative Name, or SAN, lets a certificate carry additional identities.

If a template or CA setting allows requesters to supply arbitrary SAN values, attackers may be able to request certificates that authenticate as another user.

### Issuance requirements

Issuance requirements can block abuse.

Manager approval, authorized signatures, restricted enrollment agents, and tighter subject rules all reduce risk. Their absence is often what turns convenience into compromise.

### The shortest way to reason about AD CS risk

Ask four questions:

1. Who can enroll?
2. Can the requester control the subject or SAN?
3. Does the certificate support authentication?
4. Does anything meaningful review or constrain issuance?

If the answers are too permissive, the path from low privilege to domain impact may be much shorter than expected.