# Intermediate CA details should be retrievable

Intermediate CA certificates define the intermediate links used to build trust chains from trusted roots to issued certificates.

Source: https://maester.dev/docs/tests/AD-CFG-19

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Certificate Services · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-CFG-19
```

## Overview

Intermediate CA certificates define the intermediate links used to build trust chains from trusted roots to issued certificates. If intermediate CA certificates expire, misconfigured, or unauthorized certificates are added, certificate chain validation can fail and authentication may break.

This test concentrates on *intermediate CA details* (including certificate validity) to help detect:
- Expired or soon-to-expire intermediate CAs that will break certificate chains
- Unexpected/unauthorized intermediates that expand who can issue certificates

#### Control Type

**Operational**

#### Security Recommendation
- Confirm each intermediate CA certificate is part of your approved PKI hierarchy.
- Remove unauthorized intermediates and ensure only valid chain-building intermediates are retained.
- Set renewal timelines and alerting for intermediates approaching expiration.
- If you rotate intermediates, validate that dependent relying parties and AD-integrated flows continue to validate.

#### How the Test Works
The test enumerates intermediate CA certificates in the AD configuration context, extracts relevant identifiers (e.g., subject/issuer and thumbprint) and validity periods, and reports whether each intermediate is within the expected valid timeframe.

#### Related Tests
- [Test-MtAdIntermediateCaCount](/docs/commands/Test-MtAdIntermediateCaCount)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-CFG-19 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Certificate Services |
| Area | Infrastructure hardening |
| Resource type | CertificateAuthority |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdIntermediateCaDetails](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-19.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |

</details>

## Source

- Test: [`tests/ad/config/Test.AD-CFG-19.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-19.ps1)
- Documentation: [`tests/ad/config/Test.AD-CFG-19.md`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-19.md)