adcs

README

ADCS

A library and command line interface for scraping Active Directory Certificate Services Web enrollment Service web interface.

While attempting to automate public key infrastrucutre in an enterprise environment it quickly became apparent that the common approaches such as ACME and SCEP are inadequate when dealing with devices that do not support such prototols. An example of this is a Cisco network device I was configuring. All this device is able to do is generate CSR's. SCEP/NDES - specifically the renewal part requires access to the private key in order to renew the certificate, ACME, while cool is unsuitable for use within an enterprise network.

So we are left with either interfacing with ADCS directly through the MMC or the Web Enrolment serivice. When you have a thousand devices to deploy, doing stuff manually isn't very appealing. Here is where adcscli is born. adcscli is a scraper for microsofts web enrollment services. Given a CSR and a few other pieces of information the software will interact with Active Directory Certificate Services Web Enrollment Services and hopefully retrieve a signed certificate.

Here Be Dragons

adcs is a scraper. Because Web Enrollment Services does not have an API it instead relies on regular expressions. The patterns being matched may change and this software may stop working at any time.

Installation

Head to https://github.com/jimmypw/adcs/releases for binaries for your favourite operating system.

Usage

There are two modes of operation, the first is submitting a csr. The second is checking the status of the csr.

To submit a new csr:

adcscli -new -csr csr.csr -out crt.crt -password 'supersecurepassword' -username auser -url http://192.168.252.140/certsrv/ -template webtemplate

The CSR will be submitted to the web enrollment service and will produce one of two responses.

The certificate request requires admin approval

In this case a command will be returned to the user to check the status of the request.

for example adcscli -pend -url http://192.168.252.140/certsrv/ -username 'username' -password 'password' -requestid 3395

The command will emit the exit status of 1 to indicate a pending request.

Notice that this command does not return the username and password. These are required to submit the pending request.

The certificate request was successful

In this case a certificate will be returned to the user. The certficicate can be saved to the filesystem by using the -out command line switch. If -out is not supplied the certificate will be printed to stdout.

To check the status of an existing request

The responses are the same as submitting a new CSR.

Documentation

Index

• Constants
• func BuildVersionString() string
• func NewClient() *http.Client
• func ShowSignature()
• type WebEnrollmentNewRequest
  • func (wer *WebEnrollmentNewRequest) GetServer() *WebEnrollmentServer
  • func (wer *WebEnrollmentNewRequest) Submit() (WebEnrollmentResponse, error)
• type WebEnrollmentPendingRequest
  • func (wepr *WebEnrollmentPendingRequest) GetServer() *WebEnrollmentServer
  • func (wepr *WebEnrollmentPendingRequest) Submit() (WebEnrollmentResponse, error)
• type WebEnrollmentRequest
• type WebEnrollmentResponse
  • func (wer WebEnrollmentResponse) GetCertData() []byte
  • func (wer WebEnrollmentResponse) GetRequestID() int
  • func (wer WebEnrollmentResponse) GetRequestURL() string
  • func (wer WebEnrollmentResponse) GetStatus() int
• type WebEnrollmentServer
  • func (wes *WebEnrollmentServer) CheckPendingRequest(requestid int) (WebEnrollmentResponse, error)
  • func (wes *WebEnrollmentServer) GetCACertificate() ([]byte, error)
  • func (wes *WebEnrollmentServer) GetCertificate(requestid int) ([]byte, error)
  • func (wes *WebEnrollmentServer) SubmitNewRequest(incsr []byte, template string) (WebEnrollmentResponse, error)

Constants

const (
	// SUCCESS status
	SUCCESS = 0
	// PENDING status
	PENDING = 1
	// UNAUTHORIZED status
	UNAUTHORIZED = 2
	// FAIL status
	FAIL = 3
	// DENIED status
	DENIED = 4
)

const VersionMaj = 1

VersionMaj is the major version

const VersionMin = 2

VersionMin is the minor version

const VersionPat = 1

VersionPat is the patch version

const VersionSuffix = ""

VersionSuffix is the suffix displayed after the version string.

Functions

func BuildVersionString

func BuildVersionString() string

ShowVersion Generate the version string

func NewClient

func NewClient() *http.Client

NewClient builds an http client object for ntlm authentication

func ShowSignature

func ShowSignature()

ShowSignature Generate the application signature

Types

type WebEnrollmentNewRequest

type WebEnrollmentNewRequest struct {
	// contains filtered or unexported fields
}

WebEnrollmentNewRequest handles the current request. It is not expected to be called directly but through the Submit method.

func (*WebEnrollmentNewRequest) GetServer

func (wer *WebEnrollmentNewRequest) GetServer() *WebEnrollmentServer

GetServer retrieves a pointer to the current WebEnrollment server to satisfy the interface

func (*WebEnrollmentNewRequest) Submit

func (wer *WebEnrollmentNewRequest) Submit() (WebEnrollmentResponse, error)

Submit implements the WebEnrollmentRequest interface

type WebEnrollmentPendingRequest

type WebEnrollmentPendingRequest struct {
	// contains filtered or unexported fields
}

WebEnrollmentPendingRequest is used to attempt to retrieve a pending request

func (*WebEnrollmentPendingRequest) GetServer

func (wepr *WebEnrollmentPendingRequest) GetServer() *WebEnrollmentServer

GetServer retrueves a pointer to the current WebEnrollment server to satisfy the interface

func (*WebEnrollmentPendingRequest) Submit

func (wepr *WebEnrollmentPendingRequest) Submit() (WebEnrollmentResponse, error)

Submit implements the WebEnrollmentRequest interface

type WebEnrollmentRequest

type WebEnrollmentRequest interface {
	Submit() (WebEnrollmentResponse, error)
	GetServer() *WebEnrollmentServer
}

WebEnrollmentRequest interface is implemented by the various kinds of requests that can be performed

type WebEnrollmentResponse

type WebEnrollmentResponse struct {
	// contains filtered or unexported fields
}

WebEnrollmentResponse struct contains the parsed response from adcs

func (WebEnrollmentResponse) GetCertData

func (wer WebEnrollmentResponse) GetCertData() []byte

GetCertData returns a byte array of the signed certificate

func (WebEnrollmentResponse) GetRequestID

func (wer WebEnrollmentResponse) GetRequestID() int

GetRequestID will return the request ID

func (WebEnrollmentResponse) GetRequestURL

func (wer WebEnrollmentResponse) GetRequestURL() string

GetRequestURL will reututn the url that the request was issued against.

func (WebEnrollmentResponse) GetStatus

func (wer WebEnrollmentResponse) GetStatus() int

GetStatus returns a const reflecting the status of the signing request

type WebEnrollmentServer

type WebEnrollmentServer struct {
	URL      string
	Username string
	Password string
}

WebEnrollmentServer structure defines the ADCS web enrollment server

func (*WebEnrollmentServer) CheckPendingRequest

func (wes *WebEnrollmentServer) CheckPendingRequest(requestid int) (WebEnrollmentResponse, error)

CheckPendingRequest will check to see if the request has been completed or not.

func (*WebEnrollmentServer) GetCACertificate

func (wes *WebEnrollmentServer) GetCACertificate() ([]byte, error)

GetCACertificate will retrieve the CA certificate from the server

func (*WebEnrollmentServer) GetCertificate

func (wes *WebEnrollmentServer) GetCertificate(requestid int) ([]byte, error)

GetCertificate will retrieve the specified ID certificate from the server

func (*WebEnrollmentServer) SubmitNewRequest

func (wes *WebEnrollmentServer) SubmitNewRequest(incsr []byte, template string) (WebEnrollmentResponse, error)

SubmitNewRequest will submit the WebEnrollment reqest and populate the object with the response