Microsoft certificate services
It can issue the identity that unlocks your estate — and one weak template, unavailable revocation point or mishandled CA key can undermine the whole chain.
Why ADCS
A template flag may be legitimate. A permission may be legitimate. Together, they can become a domain escalation path.
Template flags and permissions can let an ordinary user request a certificate for a privileged identity.
CRL, AIA and OCSP failures often remain invisible until clients can no longer build or validate a chain.
Software-held keys and untested backups turn a server incident into a PKI-wide recovery problem.
Flagship engagement
We assess your CA hierarchy, certificate templates, permissions, revocation infrastructure and key protection against known attack paths and operational failure modes — then hand you a risk-ranked remediation roadmap your engineers can work straight from.
Thirty minutes. Hierarchy, scale, constraints, and whether an audit is even the right first move. If it is not, we will say so. No credentials change hands on this call.
Scripted and non-intrusive. Run by your team, or by us with your team watching. Nothing is written, nothing is restarted, nothing is enrolled — and the script is yours to read first.
Templates and permissions tested against the known escalation paths. Revocation, key protection, algorithm and validity hygiene tested against operational failure modes.
Every finding with impact, exploitability and a specific remediation — ordered so that the first week of work removes the most risk.
A working session with your engineers. You can fix it yourselves, or we can. Either way you keep the documentation and the verification scripts.
Engagement record
ADCS engagements
Fixed-price assessment
We assess your CA hierarchy, certificate templates, permissions, revocation infrastructure and key protection against known attack paths and operational failure modes — then hand you a risk-ranked remediation roadmap your engineers can work straight from.
You receiveRisk-ranked findings, evidence appendix, remediation roadmap and engineer walkthrough.
Design and implementation project
A defensible hierarchy built around an offline root, resilient issuing tier, controlled templates, autoenrolment and durable revocation publishing.
You receiveArchitecture, build scripts, CP/CPS documentation, ceremony records and operational runbooks.
Scoped transformation
Modernise CA operating systems, keys, algorithms or hierarchy while preserving trust for the certificates and applications already in service.
You receiveDependency inventory, migration sequence, rollback gates, validation plan and handover.
Priority or planned support
Rapid diagnosis for failed autoenrolment, broken chains, revocation outages, template errors and suspected CA compromise.
You receiveIncident hypothesis, evidence-led diagnosis, safe recovery sequence and post-incident actions.
Common questions