# Enrollment CA certificate details should be retrievable

Enrollment-capable CA certificates include validity periods and other critical properties.

Source: https://maester.dev/docs/tests/AD-CFG-15

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Certificate Services · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-CFG-15
```

## Overview

Enrollment-capable CA certificates include validity periods and other critical properties. Expired or invalid CA certificates can break certificate issuance and domain authentication flows. In addition, unexpected certificate replacements (e.g., unknown thumbprints) can indicate PKI tampering.

#### Control Type

**Operational**

#### Security Recommendation
- Monitor CA certificate expiration and rotate certificates through an approved operational process.
- Validate certificate thumbprints/subjects/issuers against your known-good CA configuration.
- Alert when CA certificates are within your rotation window (commonly 30/60 days, depending on your policy).
- Ensure CRL/OCSP and publication settings remain correct after certificate updates.

#### How the Test Works
- Enumerates enrollment-capable CA objects in Active Directory.
- Retrieves CA certificate details associated with those enrollment services.
- Evaluates certificate validity (e.g., already expired, or expiring soon based on your configured thresholds) and highlights unexpected certificate identity details.

#### Related Tests
- [Test-MtAdEnterpriseCaCount](/docs/commands/Test-MtAdEnterpriseCaCount): Helps confirm which CAs are expected to exist.
- [Test-MtAdTrustedRootCaCount](/docs/commands/Test-MtAdTrustedRootCaCount): Validates the trust anchors that support issued certificates.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-CFG-15 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Certificate Services |
| Area | Infrastructure hardening |
| Resource type | CertificateAuthority |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdEnrollmentCaCertificateDetails](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-15.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |

</details>

## Source

- Test: [`tests/ad/config/Test.AD-CFG-15.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-15.ps1)
- Documentation: [`tests/ad/config/Test.AD-CFG-15.md`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-15.md)