Locksmith: find and fix common misconfigurations in Active Directory Certificate Services