Skip to content
CoreEncryption
Incident
Book a PKI health check Get incident support
Two-tier enterprise PKI hierarchy An offline root certificate authority protected by a hardware security module signs two online issuing authorities. Those issue certificates to user, machine, service, network-authentication, code-signing and web endpoints, and publish revocation information to CDP, AIA and an OCSP responder. TIER 0 — ROOT OF TRUST ROOT CA OFFLINE · RSA 4096 · HSM TIER 1 — ISSUING ISSUING-CA-01 POLICY · TEMPLATES ISSUING-CA-02 CODE SIGN · DEVICE TEMPLATE STORE AD CONFIG NC CDP / AIA OCSP RESPONDER TIER 2 — USERS · MACHINES · SERVICES 802.1X · CODE SIGNING · WEB

Your PKI is the foundation of trust in your network. We make sure it holds.

CoreEncryption audits, deploys and rescues enterprise PKI — with specialist depth in Microsoft ADCS, hardware security modules and certificate automation.

Book a PKI health check See what the audit finds

The situation

It was set up years ago by someone who left.

Most enterprise PKI is undocumented, unreviewed, and carrying a template misconfiguration that turns an ordinary user account into a domain administrator. Here is the shortest version of it.

The ESC1 certificate template escalation path A low-privilege user enrols against a certificate template that permits a requester-supplied subject alternative name, carries the client authentication purpose and requires no manager approval. The certificate authority issues a certificate naming a domain administrator, and the user authenticates as that administrator. ESC1 · Requester-supplied SAN Elapsed: minutes Any authenticated user NO PRIVILEGE REQUIRED Vulnerable template ENROLLEE_SUPPLIES_SUBJECT = 1 Certificate issued SAN = ADMINISTRATOR Domain compromise KERBEROS PKINIT CLIENT AUTHENTICATION EKU ENROLL GRANTED TO DOMAIN USERS NO MANAGER APPROVAL
Fig. 01 — the escalation path most Windows estates have never been checked for. All three conditions are defaults somebody once accepted. Reviewing them is a morning’s work. Finding them is the part nobody does.
01

It is an attack path

Certificate templates were configured for enrolment, not for adversaries. Most were last reviewed before the escalation research existed.

02

It is an outage waiting

One expired certificate, one unreachable CRL, one broken chain — and production stops at 03:00 on a Sunday, because the renewal was somebody’s calendar reminder.

Both problems are fixable.
Both are preventable.

Flagship engagement

The PKI / ADCS Health Check & Security Audit

We assess your CA hierarchy, certificate templates, permissions, revocation infrastructure and key protection against known attack paths and operational failure modes — then hand you a risk-ranked remediation roadmap your engineers can work straight from.

Price
Fixed, $6,000–$12,000 by environment size
Access
Read-only preferred. No changes to production.
Output
Risk-ranked report + remediation walkthrough
Book a PKI health check
Findings extract — 6 of 18 · illustrative Risk 70/100
  1. CRITICAL ESC1 Requester-supplied SAN permitted on a client-auth template Any authenticated user can enrol a certificate naming a Domain Admin.
  2. HIGH ESC4 Write permission on four templates granted to Authenticated Users A low-privilege account can rewrite one into ESC1, then enrol.
  3. HIGH KEY-01 Issuing CA private key held in software No HSM, no quorum. Key theft is a trust compromise, not an incident.
  4. HIGH REV-02 CDP and AIA URLs unreachable from outside the corporate network Revocation fails open or fails shut. Both answers are wrong.
  5. MEDIUM ALG-03 SHA-1 signatures still issued by two subordinate CAs Modern clients are already refusing them. The deadline has passed.
  6. LOW BKP-05 CA database and key backup untested in 18 months An untested restore is a plan, not a capability.

Who can exploit ESC1?

  1. 01 Domain Users Every account in the domain. No privilege, no local admin, no special access required.
  2. 02 Enrol against the template Enroll is granted to Domain Users, and no manager approval is configured.
  3. 03 Supply SAN = Administrator ENROLLEE_SUPPLIES_SUBJECT lets the requester name any principal in the certificate.
  4. 04 Authenticate as Domain Admin Kerberos PKINIT accepts the certificate. No password is ever needed, and none is changed.

Elapsed: minutes · The only trace left behind is an issued certificate

Findings shown are representative of a real ADCS assessment. Yours will be your own.

The deliverable

You don’t leave with findings. You leave with a plan.

CoreEncryption PKI security assessment

18 findings

Critical
03
High
04
Medium
06
Low
05
  • Impact, exploitability and a specific fix, per finding
  • Evidence appendix with the raw collection output
  • A verification script for every remediation

Remediation roadmap

  1. Now ESC1 and ESC8 Two template flags and one endpoint binding. Both critical escalation paths gone in an afternoon.
  2. 7 days Template ACLs and revocation reachability Strip write permissions from Authenticated Users. Publish CDP and AIA where clients can actually reach them.
  3. 30 days CA keys into hardware, SHA-1 retired Key ceremony, quorum design, re-signing plan — sequenced so no issued certificate breaks.
  4. 90 days Lifecycle automation and a tested restore Autoenrolment renewal, expiry monitoring, and a CA recovery you have actually rehearsed.

Ordered by risk removed per hour of engineering time, not by severity label. The first afternoon takes out more than the following three months.

Three pillars

Specialists, not a generalist security shop.

  • 01 ADCS Services Find dangerous configurations before attackers or outages find them.
    Two-tier ADCS hierarchy: an offline root CA above two issuing CAs, fanning out to user, machine and service endpoints.
    • Expose template and permission paths that can lead to domain compromise
    • Identify revocation, expiry and recovery weaknesses before they become outages
    • Leave your engineers with a ranked, actionable remediation plan
    See technical scope
    • Health Check & Security Audit Fixed price · risk-ranked report
    • Net-New Design & Deployment Offline root, issuing tier, CP/CPS, scripted ceremonies
    • Migration & Upgrade OS upgrades, SHA-1 remediation, re-architecture — without breaking issued certificates
    • Troubleshooting & Incident Support Autoenrolment, CRL/OCSP, chain building, suspected CA compromise
    Discuss an ADCS engagement
  • 02 HSM Services Secure private keys in hardware without breaking the chain of trust.
    Key custody inside a hardware security module An issuing certificate authority generates its private key inside a hardware security module partition. Signing requests cross the boundary inward and signatures cross back out, but the private key never leaves the hardware. ISSUING CA CERTIFICATE SERVICES PRIVATE KEY HSM PARTITION — FIPS VALIDATED CA private key NON-EXPORTABLE · QUORUM 2 OF 3 KEY NEVER LEAVES THIS BOUNDARY ↓ IN SIGN REQUEST ↑ OUT SIGNATURE ONLY STOLEN SERVER = NO STOLEN KEY
    • Keep CA private keys non-exportable and under quorum control
    • Make key custody, ceremonies and recovery evidence audit-ready
    • Migrate software-held keys into hardware with an operational handover
    See technical scope
    • Selection & sizing Network HSM vs cloud HSM, vendor-neutral
    • ADCS integration CSP/KSP configuration, partitions, firmware
    • Key ceremony facilitation Scripted, witnessed, quorum design, audit-ready record
    • Migration & operational handover Software keys into hardware, runbooks for your team
    Discuss an HSM engagement
  • 03 PKI & Encryption Services Prevent certificate outages, modernise trust and prepare the cryptographic estate for what comes next.
    Certificate lifecycle ring — enrol, deploy, monitor, renew — with the expiry point marked as the outage, beside an automation rail listing autoenrolment, ACME, SCEP and discovery.
    • Automate discovery, enrolment, renewal and revocation health
    • Modernise cloud and hybrid trust without fragmenting operations
    • Build a practical post-quantum migration roadmap from a real inventory
    See technical scope

    Prevent outages

    • Certificate Lifecycle Management & Automation Discovery, autoenrolment, ACME, SCEP/NDES with Intune
    • Managed PKI Support Retainer CRL/OCSP monitoring, change control, priority response

    Modernise

    • Cloud & Hybrid PKI Cloud-issued certificates, hybrid trust with on-prem ADCS
    • Post-Quantum Readiness Assessment Cryptographic inventory, exposure analysis, migration roadmap

    Protect keys

    • Code Signing & Software Supply Chain HSM-backed signing, timestamping, policy

    Enable

    • Identity & Network Authentication Smart cards, Windows Hello for Business, 802.1X / EAP-TLS
    • Encryption & Key Management Advisory At-rest and in-transit strategy, CP/CPS documentation
    Discuss a PKI engagement

How a health check runs

Five steps. Two weeks.
No changes to production.

  1. 01

    Scoping call

    Thirty minutes. Hierarchy, scale, constraints, and whether an audit is even the right first move. If it is not, we will say so. No credentials change hands on this call.

  2. 02

    Read-only evidence collection

    Scripted and non-intrusive. Run by your team, or by us with your team watching. Nothing is written, nothing is restarted, nothing is enrolled — and the script is yours to read first.

  3. 03

    Analysis

    Templates and permissions tested against the known escalation paths. Revocation, key protection, algorithm and validity hygiene tested against operational failure modes.

  4. 04

    Risk-ranked report

    Every finding with impact, exploitability and a specific remediation — ordered so that the first week of work removes the most risk.

  5. 05

    Remediation walkthrough

    A working session with your engineers. You can fix it yourselves, or we can. Either way you keep the documentation and the verification scripts.

scoping — call notes 
PS> Get-CAHierarchy -Summary

Forest            : corp.example.com
Enterprise CAs    : 3
  ROOT-CA-01      Offline  SHA256  RSA4096  exp 2039
  ISSUING-CA-01   Online   SHA256  RSA2048  exp 2031
  ISSUING-CA-02   Online   SHA1    RSA2048  exp 2029
Published templates : 41
Endpoints (est.)    : 5,000 – 15,000

# scope agreed. no credentials exchanged.

Representative output. Collection scripts are supplied for your review before anything runs.

What access do you need?
Read-only. A domain-joined workstation and a low-privilege account is usually enough to collect everything the assessment needs.
Will the audit disrupt production?
No. Collection performs no writes, no service restarts and no enrolments — and you can run it yourself if you would rather we never touched the estate.
Can you fix what you find?
Yes. The walkthrough is included; the remediation work itself is scoped separately, so you are never obliged to buy it.

Priority path

Autoenrolment broken? CRL outage?
Suspected CA compromise?

Describe the symptom, not just the system. The more specific you are, the faster we can tell you whether this is a template issue, a revocation issue, or something worse.

Get incident support Routed separately from routine enquiries.
Response per our stated commitment.

Revocation monitor — ISSUING-CA-01

CRL status
Expired
Next update
overdue 6h 12m
Chain build
Failed

Cache expired · EAP-TLS, VPN and code signing now refusing to validate

event viewer — application 
Source:   CertificateServicesClient-AutoEnrollment
Event ID: 13
Level:    Error

Certificate enrollment for Local system failed
to enroll for a Machine certificate with request
ID N/A from corp.example.com\ISSUING-CA-01

  The RPC server is unavailable. 0x800706ba

>> 1,412 machines in 40 minutes
This is what it looks like an hour before anyone calls it an outage.

Why us

Specialist. Vendor-neutral.
Documentation-obsessed.

We do not resell CLM platforms or HSMs, and we do not carry a partner quota. Tooling gets recommended where it is justified and nowhere else. Every engagement leaves you with procedures your own engineers can run.

Microsoft ADCS

  • Offline root CA
  • Issuing CA tier
  • Certificate templates
  • Enrolment permissions
  • AIA / CDP
  • OCSP responders
  • NDES / SCEP
  • Autoenrolment
  • CA migration & upgrade
  • CP / CPS

HSM & key custody

  • Key ceremony
  • Quorum design, M of N
  • Partition administration
  • CSP / KSP integration
  • Software-to-hardware key migration
  • Backup & restore
  • Recovery rehearsal
  • Network and cloud HSM

Certificate-based access

  • 802.1X
  • EAP-TLS
  • NPS
  • Windows Hello for Business
  • Smart cards
  • Intune SCEP & PKCS
  • ACME
  • Code signing

How we handle your access

  • Read-only access preferred and sufficient for assessment
  • NDA by default, signed before evidence collection
  • Evidence encrypted at rest, deleted on a stated retention schedule
  • Collection scripts supplied for review before they are run

Independent by design

  • No CLM or HSM reseller quota
  • Tooling recommended only where the evidence justifies it
  • Procedures and verification scripts handed over to your engineers

The capability list above describes working familiarity. No partnership or endorsement is implied.

Field notes

Technical writing for the people who operate trust.

Read all field notes
01 / ADCS The ADCS misconfigurations attackers look for first 02 / PKI Operations Why certificate outages keep happening 03 / PKI Operations Designing a two-tier PKI for the next decade

Chain complete

Certificates shouldn’t be a crisis.

Know what you have. Know where it’s vulnerable.
Know exactly what to fix next.

Book a PKI health check A 30-minute scoping call to confirm whether a health check is the right first move. No credentials exchanged and no obligation.

Already broken? Describe a symptom on the priority path