# Enumerating Certificate Templates in Doom: LDAP Module Architecture and Implementation

> Discover how the doom enumerate_templates module enumerates certificate templates using LDAP subtree searches and transforms raw attributes into readable security properties for actionable insights.

- Repository: [000pp/doom](https://github.com/000pp/doom)
- Tags: internals
- Published: 2026-02-22

---

**The `doom.modules.enumerate_templates` module handles certificate template enumeration by executing LDAP subtree searches for `pKICertificateTemplate` objects and transforming raw directory attributes into human-readable security properties.**

The 000pp/doom repository provides active directory enumeration capabilities for security assessments, with enumerating certificate templates serving as a core function for identifying PKI vulnerabilities. This capability is implemented through a dedicated Python module that connects to domain controllers, queries the certificate template container, and parses complex LDAP attributes into structured intelligence.

## The enumerate_templates Module

Certificate template enumeration in Doom is centralized in **[`src/doom/modules/enumerate_templates.py`](https://github.com/000pp/doom/blob/main/src/doom/modules/enumerate_templates.py)**. This module exposes the primary `enumerate_templates` function, which serves as the main entry point for discovering and analyzing certificate templates within an Active Directory environment.

The module performs a complete workflow from raw LDAP query to processed security data:

- Establishes the correct search base for certificate template containers
- Executes targeted LDAP searches for `pKICertificateTemplate` objects
- Safely extracts and parses binary and string attributes
- Analyzes security flags to determine template capabilities
- Returns structured dictionaries ready for UI rendering or export

## LDAP Search Strategy and Query Construction

According to the source code in [`src/doom/modules/enumerate_templates.py`](https://github.com/000pp/doom/blob/main/src/doom/modules/enumerate_templates.py) (lines 5‑17), the module constructs a specific LDAP search targeting the certificate templates container. The implementation builds a search base targeting `CN=Certificate Templates` within the domain naming context and executes a subtree search using the filter `(objectClass=pKICertificateTemplate)`.

This approach ensures comprehensive discovery of all certificate templates published in the Active Directory, including those with custom configurations or non-default security settings.

## Attribute Extraction and Parsing Pipeline

Once the LDAP search returns results, the module processes each entry through a multi-stage parsing pipeline (lines 28‑38). The implementation relies on two critical helper functions:

- **`safe_ldap_attr`** from `doom.protocols.ldap` – Safely retrieves LDAP attributes, handling missing or null values without raising exceptions
- **`parse_attribute`** from `doom.parsers.attribute` – Converts raw LDAP byte strings and structured data into native Python types

This pipeline ensures that binary flags, distinguished names, and encoded OIDs are transformed into accessible Python dictionaries while maintaining data integrity.

## Security Flag Analysis and Property Derivation

The module performs deep analysis of certificate template security characteristics through the `analyze_template_properties` function (lines 56‑90). This function interprets raw numeric flags to determine template behavior and security implications:

- **`msPKI-Enrollment-Flag`** – Determines auto-enrollment capabilities and authentication requirements
- **`msPKI-Certificate-Name-Flag`** – Controls subject name construction and supply options
- **`msPKI-Private-Key-Flag`** – Indicates whether private keys are exportable or archived
- **`flags`** – General template flags defining purpose and compatibility

The analysis produces human-readable properties such as **Auto_Enrollment**, **Exportable_Key**, and **Client_Authentication**, enabling security professionals to quickly identify templates vulnerable to ESC1, ESC2, or other certificate-based attacks.

## Result Assembly and Data Structure

After processing, the module assembles the final result structure (lines 41‑51). Each certificate template is returned as a dictionary containing:

- **`name`** – The template's canonical name
- **`display_name`** – Human-readable identifier
- **`dn`** – Full distinguished name
- **`attributes`** – Parsed dictionary of all LDAP attributes
- **`properties`** – Derived security properties from flag analysis
- **`raw`** – Original LDAP entry for advanced inspection

This structure provides both immediate usability for UI display and complete data retention for forensic analysis.

## Practical Usage Example

The following example demonstrates how to use the module to enumerate certificate templates from a domain controller:

```python
from doom.modules.enumerate_templates import enumerate_templates
from doom.protocols.ldap import get_ldap_connection

# Establish LDAP connection with domain credentials

ldap_conn, base_dn = get_ldap_connection(
    server="ldap.corp.local",
    user="CORP\\security_audit",
    password="SecurePass123!"
)

# Enumerate all certificate templates

templates = enumerate_templates(ldap_conn, base_dn)

# Process results

for template in templates:
    print(f"Template: {template['display_name']} ({template['name']})")
    print(f"  Auto Enrollment: {template['properties'].get('Auto_Enrollment', False)}")
    print(f"  Exportable Key: {template['properties'].get('Exportable_Key', False)}")
    
    # Check for high-risk configurations

    if template['properties'].get('Client_Authentication') and template['properties'].get('Exportable_Key'):
        print("  [!] Potential ESC1 vulnerability detected")
    print("-" * 40)

```

The function requires an established LDAP connection object and the domain's base distinguished name. It returns a list of template dictionaries containing both raw LDAP data and computed security properties.

## Integration with the User Interface

The enumeration functionality is integrated into Doom's user interface layer through [`src/doom/screens/main_screen.py`](https://github.com/000pp/doom/blob/main/src/doom/screens/main_screen.py) (line 6). This UI module imports `enumerate_templates` and invokes it to populate interface panels with live certificate template data, allowing security operators to browse template configurations, identify misconfigurations, and export findings without writing custom scripts.

## Summary

- The **`doom.modules.enumerate_templates`** module provides the primary interface for enumerating certificate templates in Active Directory environments.
- The implementation in [`src/doom/modules/enumerate_templates.py`](https://github.com/000pp/doom/blob/main/src/doom/modules/enumerate_templates.py) executes targeted LDAP searches for objects of class `pKICertificateTemplate` within the domain's certificate templates container.
- Raw LDAP attributes are processed using **`safe_ldap_attr`** and **`parse_attribute`** to handle binary data and missing fields gracefully.
- The **`analyze_template_properties`** function interprets PKI flags including `msPKI-Enrollment-Flag`, `msPKI-Certificate-Name-Flag`, and `msPKI-Private-Key-Flag` to identify security-relevant properties like **Auto_Enrollment** and **Exportable_Key**.
- Results are structured as dictionaries containing parsed attributes, derived properties, and raw LDAP entries for comprehensive analysis.
- The UI layer in [`src/doom/screens/main_screen.py`](https://github.com/000pp/doom/blob/main/src/doom/screens/main_screen.py) consumes this module to display certificate templates interactively.

## Frequently Asked Questions

### What module is responsible for enumerating certificate templates in Doom?

The **`doom.modules.enumerate_templates`** module handles all certificate template enumeration functionality. Implemented in [`src/doom/modules/enumerate_templates.py`](https://github.com/000pp/doom/blob/main/src/doom/modules/enumerate_templates.py), this module provides the `enumerate_templates` function that queries LDAP, parses attributes, and analyzes security flags to return structured template data.

### How does Doom parse raw LDAP attributes into readable formats?

Doom uses a two-stage parsing process. First, **`safe_ldap_attr`** from `doom.protocols.ldap` safely retrieves values while handling missing attributes. Then, **`parse_attribute`** from `doom.parsers.attribute` converts raw byte strings and structured LDAP data into native Python types such as strings, integers, and booleans.

### Which certificate template flags does Doom analyze for security assessment?

The module analyzes four critical flag attributes: **`msPKI-Enrollment-Flag`** (controls enrollment behavior), **`msPKI-Certificate-Name-Flag`** (governs subject name supply), **`msPKI-Private-Key-Flag`** (determines key exportability), and general **`flags`** (defines template purpose). These are processed by `analyze_template_properties` to generate human-readable security indicators.

### Where does Doom display the enumerated certificate template data?

The UI layer imports the enumeration module in **[`src/doom/screens/main_screen.py`](https://github.com/000pp/doom/blob/main/src/doom/screens/main_screen.py)** (line 6) and uses it to populate interface components. This allows operators to view template configurations, security properties, and potential vulnerabilities through the interactive terminal interface rather than raw JSON or CSV exports.