PKI Toolbox for Engineers,
Architects, and Administrators
Practical tools, scripts, references, and checklists for managing, troubleshooting, and securing enterprise PKI environments.
The InsecurePlanet PKI Toolbox is designed for professionals who build, operate, audit, troubleshoot, and modernize enterprise public key infrastructure. Use these resources to review Microsoft ADCS environments, validate certificate chains, troubleshoot revocation, plan migrations, review templates, and improve certificate lifecycle operations.
Free subscription required
Sign up once to unlock all free InsecurePlanet PKI Toolbox resources — checklists, worksheets, guides, and future tools.
Microsoft ADCS Tools
Health checks, CA configuration, template review, certutil references, and PowerShell assessment scripts
PKIView Troubleshooting Guide
Use PKIView.msc to review Enterprise PKI health, validate CA certificate publication, check CDP and AIA availability, identify expired or unreachable CRLs, and troubleshoot common ADCS publication problems.
- PKIView red or yellow status indicators
- CDP Location unable to download
- AIA Location unable to download
- Expired CRL warnings
- Broken HTTP CRL publication
- Old CA references after CA migration
- Offline root CRL publication validation
- PKIView cleanup after CA migration
External links leave InsecurePlanet.com and open on their respective publisher sites.
ADCS Health Check Checklist
Step-by-step checklist for reviewing your ADCS deployment — CA roles, configuration, hardening, and ESC exposure.
Certificate Template Security Review Worksheet
Structured worksheet for auditing certificate templates — EKU, enrollment rights, subject supply, and manager approval settings.
certutil Command Reference for PKI Admins
Practical certutil commands for certificate inspection, CRL validation, CA management, and troubleshooting — with examples.
ADCS CA Backup and Recovery Checklist
Checklist for backing up Root and Issuing CAs — private keys, CA database, registry, and recovery validation steps.
Enterprise Root and Issuing CA Validation Checklist
Validation checklist for newly deployed Root and Issuing CAs — configuration, publication, and enrollment testing.
ADCS PowerShell Assessment Script
PowerShell script for automated ADCS environment assessment — CA configuration, template enumeration, and ESC exposure detection.
Certificate Validation Tools
Chain validation, SAN/EKU review, TLS inspection, expiration checking, and format references
EKU and Key Usage Review Guide
Guide to Extended Key Usage OIDs and Key Usage bits — what each means, dangerous combinations, and template hardening.
Certificate Chain Validation Checklist
Checklist for validating certificate chains — trust anchors, intermediate CAs, revocation, and path length constraints.
TLS Certificate Inspection Guide
How to inspect TLS certificates using openssl, certutil, and browser tools — SANs, EKUs, key usage, and validity periods.
Certificate Expiration Review Worksheet
Worksheet for tracking certificate expiration across enterprise environments — inventory, alerting, and renewal planning.
Certificate Format Reference Guide
Reference for PEM, DER, PFX, CER, CRT, and P7B formats — conversion commands, use cases, and compatibility notes.
CRL, OCSP, CDP, and AIA Tools
Revocation infrastructure validation, CDP/AIA URL testing, OCSP troubleshooting, and PKIView cleanup
CRL/CDP/AIA Validation Checklist
Checklist for validating CRL publication, CDP URL accessibility, AIA URL accessibility, and revocation chain integrity.
PKIView Error Resolution Reference
Reference for common PKIView errors — red X, yellow warning, and missing CDP/AIA entries — with resolution steps.
OCSP Troubleshooting Checklist
Step-by-step OCSP troubleshooting — responder configuration, certificate status, network accessibility, and response validation.
HTTP PKI Publication Test Guide
How to test HTTP-based CRL and AIA publication endpoints — tools, commands, and common failure modes.
Offline Root CRL Publication Checklist
Checklist for publishing offline Root CA CRLs — scheduling, publication steps, validation, and monitoring.
Certificate Template Security Tools
ESC1–ESC8 risk review, enrollment permissions, exportable key detection, and template hardening
ESC1–ESC8 Review Checklist
Checklist for reviewing certificate templates against ESC1 through ESC8 attack paths — with detection and remediation guidance.
Certificate Template Risk Matrix
Risk matrix for classifying certificate templates by attack surface — enrollment rights, EKU, subject supply, and key exportability.
Auto-Enrollment Security Review Worksheet
Worksheet for reviewing auto-enrollment configuration — GPO settings, template permissions, and enrollment agent controls.
Code Signing Template Security Checklist
Security checklist for code signing certificate templates — key protection, EKU, enrollment rights, and timestamping requirements.
Client Authentication Template Review Guide
Guide for reviewing client authentication templates — enrollment permissions, SAN settings, and PKINIT compatibility.
PKI Architecture and Migration Tools
Offline root CA planning, issuing CA deployment, migration readiness, and legacy CA retirement
Two-Tier PKI Design Checklist
Checklist for designing a two-tier PKI hierarchy — Root CA placement, Issuing CA configuration, and publication infrastructure.
Offline Root CA Planning Guide
Planning guide for offline Root CA deployment — hardware, OS hardening, key generation, and physical security requirements.
Issuing CA Deployment Checklist
Step-by-step checklist for deploying an enterprise Issuing CA — installation, configuration, template publishing, and validation.
PKI Migration Readiness Checklist
Readiness checklist for PKI migration projects — inventory, dependency mapping, cutover planning, and rollback procedures.
Legacy CA Retirement Checklist
Checklist for safely retiring legacy CAs — certificate inventory, revocation, AD cleanup, and stakeholder communication.
Certificate Inventory Worksheet
Worksheet for building a certificate inventory — discovery methods, classification, ownership, and expiration tracking.
PKI Cutover Validation Checklist
Validation checklist for PKI cutover events — enrollment testing, revocation validation, and application compatibility checks.
PKI Architecture Decision Guide
Decision framework for PKI architecture choices — CA hierarchy depth, HSM requirements, online vs. offline roots, and cloud PKI options.
CA Compromise Response Playbook
Step-by-step playbook for responding to a CA compromise — containment, revocation, re-issuance, and stakeholder communication.
How a CA Can Be Compromised — Interactive Demo
Defensive educational demo: how CA compromise risk develops through weak governance, template misconfiguration, and poor key protection — with detection and hardening guidance.
Three-Tier PKI Design and HSM Integration Guide
Advanced guide for three-tier PKI hierarchies with HSM-backed Root CAs — design, key ceremony, and operational procedures.
EAP-TLS, Wi-Fi, VPN, and Identity Tools
Cisco ISE, EAP-TLS validation, machine/user certificates, NPS/RADIUS, VPN, and smart card troubleshooting
Cisco ISE EAP-TLS Certificate Checklist
Checklist for validating certificates used in Cisco ISE EAP-TLS deployments — CA trust, template settings, and revocation.
Machine Certificate Validation Guide
Guide for validating machine certificates — auto-enrollment, template settings, chain validation, and NPS compatibility.
VPN Certificate Troubleshooting Guide
Troubleshooting guide for VPN certificate issues — chain validation, revocation, EKU requirements, and common failure modes.
Smart Card / PIV Certificate Review Checklist
Checklist for reviewing smart card and PIV certificate deployments — template settings, PKINIT, and logon validation.
Identity Certificate Troubleshooting Worksheet
Worksheet for diagnosing identity certificate issues — enrollment failures, revocation errors, and authentication problems.
Code Signing, S/MIME, and Document Signing Tools
Code signing templates, timestamping, S/MIME planning, document signing, HSM-backed signing
Code Signing Security Checklist
Security checklist for code signing deployments — key protection, HSM requirements, timestamping, and certificate lifecycle.
S/MIME Certificate Planning Guide
Planning guide for enterprise S/MIME deployments — certificate templates, auto-enrollment, key archival, and client configuration.
Document Signing Certificate Checklist
Checklist for document signing certificate deployments — EKU requirements, key protection, and signing workflow validation.
Timestamp Authority Review Guide
Guide for selecting and validating timestamp authorities — RFC 3161 compliance, long-term validation, and TSA certificate requirements.
HSM-Backed Signing Readiness Checklist
Readiness checklist for HSM-backed signing deployments — HSM selection, key ceremony, integration, and operational procedures.
PQC and Crypto-Agility Tools
Post-quantum readiness, crypto-agility planning, NIST standards tracking, and cryptographic inventory
PQC Readiness Checklist
Checklist for assessing post-quantum cryptography readiness — cryptographic inventory, algorithm exposure, and migration planning.
Crypto-Agility Planning Worksheet
Worksheet for planning crypto-agility — algorithm dependencies, system inventory, migration priority, and timeline planning.
Cryptographic Inventory Template
Template for building a cryptographic inventory — algorithms in use, key lengths, certificate lifetimes, and system dependencies.
Hybrid Certificate Planning Guide
Guide for planning hybrid certificate deployments — combining classical and post-quantum algorithms for transition-period security.
Post-Quantum PKI Migration Roadmap
Four-phase migration roadmap for transitioning enterprise PKI to post-quantum algorithms — inventory, pilot, migration, and validation.
NIST PQC Standards Quick Reference
Quick reference for NIST post-quantum standards — ML-KEM, ML-DSA, SLH-DSA, FN-DSA, and HQC — with algorithm selection guidance.
Harvest-Now-Decrypt-Later Risk Assessment
Risk assessment framework for evaluating HNDL exposure — data classification, encryption inventory, and prioritization guidance.
External Trusted Resources
Curated links to official documentation, research, and trusted public tools — links open on external sites
Downloadable Resources
InsecurePlanet-created checklists, worksheets, and runbooks for enterprise PKI operations
ADCS Health Check Checklist
Comprehensive ESC1–ESC13 assessment checklist with CA hardening and enrollment endpoint review.
PKI Migration Readiness Checklist
Readiness assessment for PKI migration projects — inventory, dependencies, cutover, and rollback.
Certificate Template Security Review Worksheet
Structured worksheet for auditing all certificate templates against ESC attack paths.
CRL/CDP/AIA Validation Checklist
Validation checklist for revocation infrastructure — CRL publication, CDP/AIA URLs, and OCSP.
PQC Readiness Checklist
Post-quantum cryptography readiness assessment — algorithm inventory, exposure, and migration planning.
Post-Quantum PKI Migration Roadmap
Four-phase roadmap for transitioning enterprise PKI to post-quantum algorithms — inventory through validation.
Certificate Inventory Worksheet
Worksheet for building a full enterprise certificate inventory with expiration tracking.
Enterprise PKI Assessment Toolkit
Complete toolkit combining ADCS health check, template review, and revocation validation checklists.
Offline Root CA Build Runbook
Step-by-step runbook for building and commissioning an offline Root CA from scratch.
Issuing CA Build Runbook
Step-by-step runbook for deploying an enterprise Issuing CA — installation through production validation.
PKI Web Publication Runbook
Runbook for configuring HTTP-based CRL and AIA publication — IIS setup, URL testing, and monitoring.
CA Compromise Response Playbook
Step-by-step playbook for CA compromise response — containment, revocation, re-issuance, and communication.
The InsecurePlanet PKI Toolbox is provided for educational and defensive cybersecurity purposes. Always validate tools, scripts, commands, and guidance in a lab or test environment before using them in production. Follow your organization's change control, security, and compliance processes.