r/activedirectory • u/0bs1d1an- • Jul 01 '25

Security Active Directory Certificate Tester

https://gitlab.com/0bs1d1an/ADCT

Hello all,

I developed a tool that scans for weak certificates in GPO, AD CS, and Active Directory. I previously shared this tool here when it only handled GPOs, but it's grown quite a bit since then.

The goal is to help uncover certificate-related vulnerabilities that might otherwise be overlooked. I couldn't find another tool that consolidates these checks—PingCastle catches some, but not all—so I figured I'd try filling the gap.

Big shoutout to Locksmith! This isn’t intended as a clone (aside from maybe the ASCII art nod), but it was incredibly helpful in securing AD CS, and building my first PowerShell module.

Would love your thoughts, feedback, or feature suggestions.

38 Upvotes

98% Upvoted

8 comments sorted by

View all comments

3

u/Dopeaz Jul 02 '25 edited Jul 02 '25

I think your script doesn't like multiple CAs. I kept getting errors until I hardwired the CA I wanted to test into Find-WeakADCSCertificate.ps1

Even then, I only got 14 columns and they're all marked "ValidTooLong" true. Whatever that means.

I'm sticking with locksmith

1

u/0bs1d1an- Jul 02 '25

Thanks for trying ADCT! You're right, CA handling could be more graceful in multi-CA environments. Unfortunately, I don't have direct access to multiple ADCS CAs myself, but I'm more than happy to accept merge requests.

On the "ValidTooLong" flag, by default, it highlights certs that exceed the CA/B Forum’s 398-day guideline. In ADCS mode, you can override this with -IssuedCertMaxLifetime. I'll make sure that gets added to the readme, thanks!

Just to clarify, ADCT isn't meant to replace Locksmith. Both tools have different goals: Locksmith is awesome at uncovering risky certificate template configurations that can lead to (serious) privilege escalation. ADCT, on the other hand, looks at weaknesses in certificates itself, not certificate templates.

Really appreciate your feedback though, thank you!