Configuring Certificate Authority With Openssl

TL;DR

• 目的：Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptograph…
• 适用：AD/网络/红队场景（项目全量测试）
• 输入：AD CS 服务器 + 证书模板
• 输出：渗透证据链 + 复现步骤
• 红线：仅 A 模式项目全量测试，B 模式禁用；禁止未授权使用
• 关联：上游：003-src-session-start → 下游：097-exploiting-active-directory-with-bloodhound, 079-enumerating-cloud-with-cloudfox, 098-exploiting-adcs-with-certipy

Configuring Certificate Authority with OpenSSL

Overview

A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This skill covers building a two-tier CA hierarchy (Root CA + Intermediate CA) using OpenSSL and the Python cryptography library, including CRL distribution, OCSP responder configuration, and certificate policy management.

When to Use

• When deploying or configuring configuring certificate authority with openssl capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Familiarity with cryptography concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Create a Root CA with self-signed certificate
• Create an Intermediate CA signed by the Root CA
• Issue server and client certificates from the Intermediate CA
• Configure Certificate Revocation Lists (CRLs)
• Implement certificate policies and constraints
• Build a complete PKI hierarchy programmatically

Key Concepts

CA Hierarchy

Root CA (offline, air-gapped)
  |
  +-- Intermediate CA (online, operational)
        |
        +-- Server Certificates
        +-- Client Certificates
        +-- Code Signing Certificates

Certificate Extensions

Security Considerations

• Root CA private key must be stored offline (air-gapped HSM)
• Use minimum 4096-bit RSA or P-384 ECDSA for CA keys
• Set path length constraints on intermediate CAs
• Implement certificate policies (OIDs)
• Enable CRL and OCSP for revocation checking
• Audit all certificate issuance operations

Validation Criteria

• Root CA self-signed certificate is valid
• Intermediate CA certificate chains to Root CA
• Issued certificates chain to Intermediate -> Root
• Path length constraints are enforced
• CRL is generated and accessible
• Revoked certificates appear in CRL
• Certificate policies are correctly embedded

Output Format

{
  "attack_path": "<chain summary>",
  "steps": [
    {"step": 1, "action": "<technique>", "tool": "<tool>", "result": "<outcome>"},
    ...
  ],
  "evidence": "<log/screenshot path>",
  "impact": "<DA/Admin/DC compromise / credential dump / etc>",
  "cleanup": "<artifact removal checklist>"
}

Save to share/intel/findings/<target>-<ad-<timestamp>.md.

Tools & Systems

• BloodHound — AD attack path graph
• Impacket — Python AD exploitation toolkit
• CrackMapExec — AD/SMB enumeration & exploitation
• Certipy — AD CS exploitation
• NetExec — Modern CrackMapExec fork
• evilginx2 — AiTM credential harvesting
• Mimikatz — Windows credential extraction

All tools require prior 002-src-session-start confirmation for A mode. B mode禁用所有攻击工具。

Workflow

1. Recon — BloodHound collection via SharpHound or bloodhound-python
2. Path analysis — Identify shortest path to DA via BloodHound UI
3. Initial access — Phishing (evilginx) or valid creds (compromised)
4. Lateral movement — CrackMapExec / Impacket / NetExec across hosts
5. Privilege escalation — ADCS, Kerberoast, Shadow Credentials, etc.
6. DA/DC compromise — DCSync or mimikatz sekurlsa::logonpasswords
7. Cleanup — Remove artifacts, clear logs (if authorized)

Advanced Techniques

ACL Abuse Chains

GenericAll + WriteDACL combinations can yield DA in 3 hops. Use BloodHound's "Shortest Paths to Domain Admins" query.

Cross-Forest Attacks

SID filtering misconfigurations allow cross-forest privilege escalation via trust relationship abuse.