Lire en : 
Français
Hello everyone,
I started a new project on my GitHub: a Python ADCS server.
This project comes from a simple observation: some clients need automatic enrollment on their Windows machines, for example to handle 802.1x. Windows can do this with an ADCS. But when the client wants a Linux server (because they already use Samba4), there are not many turnkey solutions available.
This project therefore emulates an ADCS enrollment server (not a client). It reproduces the behavior of Microsoft ADCS Web Enrollment endpoints (CEP/CES) to handle certificate requests.
The goal is to emulate a Web ADCS enrollment server that provides CEP policy (templates, CA, etc.) to requesting clients, receives and validates PKCS#10 CSRs, and processes submissions via CES to return signed responses.
In this project, certificate templates are not declared in the usual configuration. They are defined via Python callbacks. Each template is represented by an external module (for example callbacks/user_template.py) exposing two required functions: define_template(app_conf, kerberos_user) → dynamically describes template properties based on the user/context, and emit_certificate(...) → takes the CSR and metadata, applies necessary extensions, and issues the signed certificate.
This design transfers most security controls to the callback author. Eligibility controls must be implemented inside the callback. If the callback does not perform checks, any authenticated user can obtain any certificate returned by the module. The Python ADCS server imposes no additional restrictions.
The project was largely coded with AI assistance (useful for converting unreadable Microsoft RFCs into functional code). The project is still in its early stages, but feel free to send feedback!
Français
