Certipy Authenticate with Certificate

Authenticate using a PFX certificate to obtain a TGT and NT hash

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: certipy
Category: Credential Attacks / ADCS (Certificate Abuse)
Platform: linux
Requires: no credentials
Protocols: LDAP, KERBEROS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

certipy auth -pfx '<pfx_file>' -dc-ip <ip>

Examples

certipy auth -pfx 'administrator.pfx' -dc-ip 192.168.1.100

Tags

certipy adcs certificate authentication pfx pkinit

Evil-WinRM Shell Windows Remote Management shell connection
Impacket PSExec Execute commands via PSExec service
bloodyAD Shadow Credentials Add a Key Credential (msDS-KeyCredentialLink) to a target object you have GenericWrite…
Certipy Account Operations Create, update, read, or delete user / computer accounts directly through Certipy.…
Certipy CA Management Enumerate and manipulate the certificate authority itself: list officers (ESC7), backup…
Certipy ESC1 (Subject in Request) Exploit ESC1: a template that allows the requester to specify a Subject Alternative Name…
Certipy ESC11 (RPC Relay to ICPR) ESC11: ICertPassage RPC interface accepts NTLM without IF_ENFORCEENCRYPTICERTREQUEST.…
Certipy ESC13 (OID Group Link) ESC13: a template's issuance policy is linked to a privileged group via…