https://josupalacios99.github.io/blog/en/tags/adcs/Recent content in adcs on root@j0suHugoen-US2026 root@j0su · think like the adversaryTue, 30 Jun 2026 10:00:00 +0200https://josupalacios99.github.io/blog/en/posts/adcs-ntlmrelayx-sid-extension/Tue, 30 Jun 2026 10:00:00 +0200https://josupalacios99.github.io/blog/en/posts/adcs-ntlmrelayx-sid-extension/ADCS relay with ntlmrelayx generates certificates that certipy v5 rejects with ‘Object SID mismatch’. The root cause is KB5014754: modern DCs require the certificate to contain the user’s SID in a Microsoft-proprietary extension. ntlmrelayx doesn’t include it. Here’s why and how to fix it.