https://brkrops.ca/blog/ Long-form technical writing — ADCS, PKI, identity and Windows Server. en-CA Thu, 06 Aug 2026 00:00:00 +0000 BrkrOps Inc. https://brkrops.ca/blog/the-garage-didnt-burn-down/ https://brkrops.ca/blog/the-garage-didnt-burn-down/ Thu, 06 Aug 2026 00:00:00 +0000 43 Domain Admins, each certain their corner is separate. Seven of them chained one delegation at a time is all it takes to own the forest. https://brkrops.ca/blog/the-registration-authority-makes-the-certificate/ https://brkrops.ca/blog/the-registration-authority-makes-the-certificate/ Tue, 04 Aug 2026 00:00:00 +0000 NDES signs whatever it is asked to sign. Local admin plus a weak template turns it into domain admin certificates issued by your own CA. https://brkrops.ca/blog/the-certificates-that-break-wifi/ https://brkrops.ca/blog/the-certificates-that-break-wifi/ Sun, 02 Aug 2026 00:00:00 +0000 NDES holds two service certificates that do not auto-renew. When they expire, SCEP enrollment stops and certificate-based WiFi goes down. The one-hour fix. https://brkrops.ca/blog/code-signing/ https://brkrops.ca/blog/code-signing/ Tue, 28 Jul 2026 00:00:00 +0000 An enterprise code-signing certificate on a developer's laptop — no HSM, no audit — signs a backdoor Windows trusts. It is a Tier 0 credential, not a tool. https://brkrops.ca/blog/the-model-has-no-answer/ https://brkrops.ca/blog/the-model-has-no-answer/ Thu, 23 Jul 2026 00:00:00 +0000 An attacker pivots from a Tier 2 workstation to the whole forest through SCCM. The model calls SCCM, Intune and backup Tier 1 — each owns Tier 0. https://brkrops.ca/blog/the-notary-cannot-carry-the-seal/ https://brkrops.ca/blog/the-notary-cannot-carry-the-seal/ Tue, 21 Jul 2026 00:00:00 +0000 An HSM-backed CA can pass every health check and still fail to publish a CRL, because its signing key lives across a network round trip. https://brkrops.ca/blog/two-writes/ https://brkrops.ca/blog/two-writes/ Thu, 16 Jul 2026 00:00:00 +0000 Two things on a certificate template are called Write — the ACL, and the Supply-in-the-request setting. Confusing them opens a domain-admin path. https://brkrops.ca/blog/cloud-pki-is-free/ https://brkrops.ca/blog/cloud-pki-is-free/ Fri, 10 Jul 2026 00:00:00 +0000 Intune Cloud PKI is bundled into Microsoft 365 E5 — but almost no enterprise is 100% E5. A five-year TCO against ADCS, and what Cloud PKI still cannot do. https://brkrops.ca/blog/the-companies-i-wont-give-my-data-to/ https://brkrops.ca/blog/the-companies-i-wont-give-my-data-to/ Mon, 06 Jul 2026 00:00:00 +0000 Twelve years building certificate infrastructure for hospitals, banks and police taught me which organizations quietly accept a known, fixable risk. https://brkrops.ca/blog/the-locked-door/ https://brkrops.ca/blog/the-locked-door/ Tue, 30 Jun 2026 00:00:00 +0000 Your User template, a forgotten key recovery agent and one phished user are all an attacker needs to lock files with no decryption path. https://brkrops.ca/blog/your-backup-is-the-breach/ https://brkrops.ca/blog/your-backup-is-the-breach/ Tue, 23 Jun 2026 00:00:00 +0000 Why backing up Tier 0 like a file server is how an attacker walks off with your CA's private key — and how to back up DCs and CAs safely. https://brkrops.ca/blog/validityperiodunits/ https://brkrops.ca/blog/validityperiodunits/ Sat, 20 Jun 2026 00:00:00 +0000 Why a CAPolicy.inf root issues one-year subordinate certificates no matter what you typed — and the ValidityPeriodUnits ceiling that controls it. https://brkrops.ca/blog/come-back-to-cdp/ https://brkrops.ca/blog/come-back-to-cdp/ Thu, 18 Jun 2026 00:00:00 +0000 Why your CRL distribution point doesn't belong on the CA, and probably shouldn't be in LDAP either. https://brkrops.ca/blog/reading-ad-certificate-template-attributes/ https://brkrops.ca/blog/reading-ad-certificate-template-attributes/ Wed, 17 Jun 2026 00:00:00 +0000 A field guide to the attributes behind a certutil -dsTemplate dump: what each one does, and which ones you can actually change. https://brkrops.ca/blog/nac-with-x509/ https://brkrops.ca/blog/nac-with-x509/ Mon, 15 Jun 2026 00:00:00 +0000 What 802.1X with EAP-TLS actually buys you, where the exceptions creep in, and why NAC is a PKI project — not a network project. https://brkrops.ca/blog/certificate-templates-live-in-active-directory/ https://brkrops.ca/blog/certificate-templates-live-in-active-directory/ Sat, 13 Jun 2026 00:00:00 +0000 Where certificate templates actually live, and what that means for hardening your PKI. https://brkrops.ca/blog/a-ca-is-a-ca/ https://brkrops.ca/blog/a-ca-is-a-ca/ Fri, 12 Jun 2026 00:00:00 +0000 Why your Certification Authority should do exactly one thing, and what to keep off it. https://brkrops.ca/blog/replace-a-default-certificate-template/ https://brkrops.ca/blog/replace-a-default-certificate-template/ Sun, 07 Jun 2026 00:00:00 +0000 How to replace a default certificate template, in three steps. https://brkrops.ca/blog/twenty-five-years-default-templates/ https://brkrops.ca/blog/twenty-five-years-default-templates/ Sat, 06 Jun 2026 00:00:00 +0000 Why the default certificate templates in every ADCS install are the foundation of most ESC findings.