Certipy is an open-source Python toolkit, published under the MIT licence on PyPI as certipy-ad, for enumerating and abusing Active Directory Certificate Services (AD CS), built for red teamers, penetration testers, and defenders who need to assess AD CS misconfigurations in Windows Active Directory environments.

What it is

Certipy is an offensive and defensive toolkit that targets Active Directory Certificate Services, the PKI component that issues and manages certificates inside a Windows Active Directory forest. It lives in the security tooling ecosystem alongside other Active Directory attack and enumeration tooling, and it is written in Python, requiring Python 3.12 or later. The project is developed by @ly4k with contributions from the community, carries the adcs and pki topics, and holds roughly 3,670 stars and 484 forks on GitHub.

The concrete problem it solves is that AD CS deployments are frequently misconfigured in ways that allow an attacker to escalate privileges or persist inside a domain without ever touching a password. Certificate templates, certificate authority settings, and enrolment permissions are hard to inspect by hand and easy to get wrong, and the resulting weaknesses map to a known catalogue of attack paths. Certipy replaces manual inspection and one-off scripts with a single tool that discovers the configuration, flags the weaknesses, and carries an assessment through to requesting or forging a certificate and authenticating with it.

Key capabilities

• Discover Certificate Authorities and certificate templates across an AD CS deployment.
• Identify misconfigurations and map them to known attack paths.
• Detect and exploit the full range of ESC1 through ESC17 AD CS vulnerabilities.
• Request and forge certificates, including support for Golden Certificates.
• Perform authentication to services using a certificate rather than a password.
• Relay NTLM authentication to AD CS HTTP(S) and RPC endpoints.
• Support Shadow Credentials and Certificate Mapping Attacks.

Who uses it and how

• Red teamers use it to enumerate AD CS, request certificates, and authenticate with them during an engagement.
• Penetration testers use it to validate whether certificate template misconfigurations are actually exploitable rather than only suspected.
• Defenders use the same enumeration and misconfiguration detection to find and fix weaknesses in their own certificate services before an attacker does.
• Engagements that reach NTLM relay against AD CS HTTP(S) or RPC endpoints use the relay capability to move from captured authentication to a usable certificate.
• Anyone running it is expected to do so only in environments where they hold explicit authorization, because unauthorized use may be illegal.

Getting started

Certipy is distributed on PyPI as certipy-ad and installs with pip install certipy-ad; the project's README directs new users to the Certipy Wiki Installation Guide and Quick Start Guide for exact steps and common command examples.

How it compares

This registry entry names no paid products that Certipy replaces, and it names no directly comparable open-source tools either, so the honest statement is that Certipy stands alone here on the strength of its own description. Anyone weighing it against other AD CS tooling will need to look outside this page, because no such comparison is supported by the facts available.

When to use it — and when not to

Pick Certipy when the assessment targets Active Directory Certificate Services and the operator has written authorization for the environment, since the tool is explicitly offensive and unauthorized use may be illegal. It is not the right choice for anyone without that authorization, nor for anyone unwilling to run Python 3.12 or later. The README is deliberately sparse and pushes the real detail — installation, usage, vulnerability explanations, and mitigations — into the external wiki, so expect to leave the repository to learn how to drive it; the licence, authorship, and activity are all clear, with the last push in late July 2026 and 25 open issues.