New Open-Source Tool Spotlight

Active Directory Certificate Services (AD CS) can be a goldmine if misconfigured. Tools like Certipy simplify enumeration and abuse, leveraging techniques like Shadow Credentials, Golden Certificates, and domain escalation paths (ESC1-ESC11). #CyberSecurity #RedTeam

Certipy's `shadow` command exemplifies ADCS weaknesses. By manipulating `msDS-KeyCredentialLink`, you can take over accounts via PKINIT. It's seamless but devastating for privilege escalation. #Pentesting #ActiveDirectory

Golden Certificates mimic Golden Tickets but target ADCS. Using a compromised CA private key, an attacker can forge certs for domain controllers or users. Certipy automates this process—caution with CA backups. #InfoSec #PKI

Project link on #GitHub https://github.com/ly4k/Certipy

#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity

—
P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking

So it's official: TLS certificate lifetimes will reduce from the current max of 398 days to:
* 200 days in March 2026
* 100 days in March 2027
* 47 days in March 2029

For web servers/proxies etc. it's reasonably simple, at least for smaller orgs but for e.g. network kit it might be more of a challenge. Having a timeframe to aim at definitely focusses the mind!

Via @riskybiz / https://risky.biz/risky-bulletin-ca-b-forum-approves-47-day-tls-certs/

Buckle up, kids. Automate your certificate rotations or die trying. WebPKI certificate validity period will be 47 days by 2029. https://www.bleepingcomputer.com/news/security/ssl-tls-certificate-lifespans-reduced-to-47-days-by-2029/

rpki-client 9.5 released https://www.undeadly.org/cgi?action=article;sid=20250412123402 #openbsd #rpkiclient #rpki #bgp #pki #crypto #cryptography #security #routing #bgp #networking #freesoftware #libresoftware

Imagine: a journalist’s investigation collapses after certificate compromise.
A hypothetical? Yes.
A real risk? Absolutely.
This is why public trust infrastructure matters.
https://www.linuxfoundation.org/blog/the-view-from-here

Revamping Web PKI: The Push for Shorter Certificate Validity and Data Reuse Periods

The ongoing evolution of the Web Public Key Infrastructure (PKI) is crucial for enhancing internet security. Recent proposals to shorten certificate validity and data reuse periods aim to address exis...

https://news.lavx.hu/article/revamping-web-pki-the-push-for-shorter-certificate-validity-and-data-reuse-periods

Just spent some quality time figuring out why HTTPS requests with incorrect system time would fail - even though the time was between the certificate NotBefore and NotAfter.

OCSP stapling was the culprit. This adds a more strict "window of system time validity" due to the way the protocol works. The obvious reason for the smallish window is to allow caching, while reducing the replay attack possibilities. Thus, the system clock can't be backdated more than a few hours, regardless of certificate NotBefore. The system time can be more off towards the future.

In our use case, we don't need to worry about revocation and hence we will just kill OCSP use. With this, we will still have the limits set by the certificate NotBefore and NotAfter, but at least they're more predictable and somewhat laxer.

Heutiger Aha-Moment: #PGP-Key-Verteilung über die eigene #Webseite, komplett ohne zentralisierte #Keyserver o.ä. - sehr schön! Gleich eingerichtet.
Macht Ihr auch mit?

https://blog.mister-muffin.de/2025/03/31/til-openpgp-web-key-directory/

This is what innovation can do!

#AirGapped #Offline #PKI #PrivateKeys #TwoFactor- #2FA #Yubico #Yubikey

======

Vincent Bernat Turns Three YubiKeys and a Cheap Single-Board Computer Into a Secure Offline PKI
https://www.hackster.io/news/vincent-bernat-turns-three-yubikeys-and-a-cheap-single-board-computer-into-a-secure-offline-pki-1735b4ad7fc2

---
Developer Vincent Bernat demonstrates how to turn three Yubico YubiKey USB two-factor authentication dongles into an offline public key infrastructure (PKI) using a low-cost single-board computer as an air-gapped host.

Is today #FediHire Friday? Sure looks like it!

What I'm looking for: A senior level, individual contributor role supporting Windows, Active Directory, Certificates, PKI, Azure, and information security in a large environment. Interested in relocating outside of the US. I like to solve weird problems and make computers run smoothly. I want to help others use technology effectively.

My main focus the last few years has been rebuilding and modernizing a struggling certificate management team. That includes growing the team to meet our company needs, migrating our AD-integrated private PKI stack, getting a handle on our web PKI consumption, and making massive improvements to our certificate lifecycle management platform. I supported and advised our CyberSec and Desktop teams as we rolled out multi-factor authentication to 50,000 employees and contractors across the US. My background in understanding deep computer fundamentals, talent for quickly grasping nuances of larger systems, and calmness in a crisis have contributed to quickly resolving major technology outages regardless of root cause.

This role hasn't been exclusively technical. A big part of my current job is building relationships with our developers to help them understand how certificates work, the responsible ways to use them, and what our relevant internal policies are. I've been training and teaching junior and mid-level engineers both practical PKI concepts and our specific enterprise requirements. I've gotten to spend some time with upper management to both explain the immediate challenges we've had and the plans we can implement improve our infrastructure, reducing costs and outages.

While this position has been focused on certs and how to use them, I'm very comfortable considering a technical leadership role for Windows (server and desktop) administration and Active Directory. I also have some good experience with Azure and virtualization platforms, but they haven't been my daily focus for several years.

My current employer is direct retail for general public consumers. I've also worked in banking/finance, manufacturing, and architecture firms. The common thread is I love to help people leverage technology for their goals, to help them be more effective.

In my personnel/volunteer time I've done very similar: working backstage with lights/sounds/projections so live performers can do their best.

Right now I'm in Syracuse, New York (about five hours from NYC), but I'm open to relocation/migration anywhere in the world.

PMs open if you want to talk details. Boosts/reshares appreciated.

Is there a good read on how to use certificates, private keys and all the things. I'm trying to sign a PDF and I need a #pki or a nssdb, and I have no clue what these things are. I know #ssh I can use for git and #gpg for encrypting files. But why do I have to run `openssl pkcs12 -export` after `openssl req -x509`? Is there a unified theory on certificates?

Forkbomb B.V. is a member of the PKI Consortium!

The Public Key Infrastructure Consortium unites leading organizations to enhance trust in assets and communication via PKI, improving internet security. By collaborating with users, regulators, and stakeholders, the consortium tackles real-world issues effectively.

https://pkic.org/members/forkbomb/

Как реализовать пакетную подпись PDF-документов

Автоматическое подписание документов электронной подписью используют там, где требуется пакетная подпись документов без участия сотрудника. Это могут быть как небольшие сайты, например по продаже билетов в театр и музей, или порталы с онлайн-обучением при отправке сертификатов о прохождении курсов, так и крупные банковские приложения, например, при генерации выписок по счетам, форм договоров или квитанций. В ЕСИА, СМЭВ, ГИС ЖКХ и других государственных информационных системах также реализована автоматическая подпись. В этой статье реализуем автоматическое подписание для PDF-файлов и добавим штамп «Документ подписан электронной подписью».

https://habr.com/ru/articles/890054/

It's been a while since I've needed to be overly concerned about the operational matters of PKI...

Reflecting on a recent highly visible certificate expiration with one of my esteemed colleagues led me to learn of https://dadrian.io/blog/posts/sct-not-after/, which seems like a welcome feature...

Предложение Mozilla по отзыву случайных сертификатов

Разработчики Mozilla выступили с интересным предложением по оздоровлению инфраструктуры сертификатов TLS и инфраструктуры открытых ключей (PKI) в целом. Среди прочего, Центрам Сертификации предлагается массово отзывать у пользователей сертификаты, чтобы подтолкнуть их к автоматизации. Для тестирования системы ежегодно отзыву подлежит 30 случайных сертификатов.

https://habr.com/ru/companies/globalsign/articles/889392/

Feel free to test this - https://testflight.apple.com/join/FRMUTdnW - an app I'm working on for verification of authorship of photos (through PKI challenges - through the stored private keys of the author) - for more info feel free to contact me.
-
The project page is at https://2p0.space
#cybersecurity #testing #pki

The SignServer team is happy to announce the community release of SignServer 7.0.0:

https://github.com/Keyfactor/signserver-ce/releases/tag/v7.0.0

Let's Encrypt soon starts offering TLS certificates with just 6 days of lifetime. It's just an option and the 90 day certs are also still offered but I doubt that this will add a lot of security.

https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/

Based on the number of occasions, I already had problems with the 90days renewals in the past (software bugs and human error), I see this the value in this move rather sceptical.