Skip to content

Conversation

@P-aLu
Copy link

@P-aLu P-aLu commented Apr 29, 2025

Thank you for the original work.

I wanted to add another way to perform the same kind of actions without dumping information from the CA.
The fact is that when CA key is dumped, you need to fully rebuild the PKI if you want to be sure the dumped key is no longer valid, which can be a mess

I added an 'esc1' action which let the user request certificates with alt_upn for the collected domain users. By default, the SubCA template is used (almost always enabled and has EnrolleeSuppliesSubject flag). The user might chose the template he wants to request with the already present -template option.

This action may take much more time than the golden one.

image

@zblurx
Copy link
Owner

zblurx commented Jun 5, 2025

Hey, great work, thanks @P-aLu !
The only thing I think it would be better to change is about the -template parameter being shared by golden and esc1 actions. I would prefer that esc1 action uses another parameter to avoid confusion. Maybe -template-name ?
Also, could you update the README.md please ? Thanks

@P-aLu
Copy link
Author

P-aLu commented Jun 6, 2025

Hello @zblurx

Thank you for reviewing. I made the modifications you suggested.

Feel free to modify any file you want :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants