CertCheck.psm1

<#
#>


########
# Global settings
$ErrorActionPreference = "Stop"
$InformationPreference = "Continue"
Set-StrictMode -Version 2

<#
#>

Function New-NormalisedUri
{
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')]
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true)]
        [ValidateNotNull()]
        $UriObj,

        [Parameter(Mandatory=$false)]
        [switch]$AsString = $false
    )

    process
    {
        # If it's not a URI, attempt to convert to Uri directly
        $uri = $UriObj
        if ($uri.GetType().FullName -ne "System.Uri")
        {
            try {
                $uri = [Uri]::New($uri)
            } catch {
                Write-Verbose "Input could not be converted to Uri directly"
            }
        }

        # If it's still not a URI, attempt to convert to Uri with a https:// prefix
        if ($uri.GetType().FullName -ne "System.Uri")
        {
            try {
                $uri = [Uri]::New("https://" + $uri)
            } catch {
                Write-Verbose "Input could not be converted to Uri with https scheme prefix"
            }
        }

        # If it's still not a URI, then fail the normalisation
        if ($uri.GetType().FullName -ne "System.Uri")
        {
            Write-Error "Failed to convert object to uri"
        }

        # Ensure the URI is lowercase and the path is absent
        $tempUri = [Uri]::New($uri.AbsoluteUri.ToLower())
        $uri = [Uri]::New(("{0}://{1}:{2}" -f $tempUri.Scheme, $tempUri.Host, $tempUri.Port))

        # Pass the Uri on
        if ($AsString)
        {
            $uri.ToString()
        } else {
            $uri
        }
    }
}

Function Get-CertificateExtension
{
    [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', '')]
    [OutputType('System.String')]
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [string]$Oid,

        [Parameter(Mandatory=$true)]
        [AllowNull()]
        [AllowEmptyCollection()]
        [PSCustomObject[]]$Extensions
    )

    process
    {
        # Handle an empty extensions list
        if (($Extensions | Measure-Object).Count -eq 0)
        {
            [string]::Empty
            return
        }

        $content = $Extensions |
            Where-Object { $null -ne $_ -and $_.Oid -eq $Oid } |
            Select-Object -First 1 |
            ForEach-Object { $_.Value }

        if ([string]::IsNullOrEmpty($content))
        {
            [string]::Empty
        } else {
            $content
        }
    }
}

Function Get-CertificateData
{
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true)]
        [ValidateNotNull()]
        [Uri]$Uri,

        [Parameter(Mandatory=$true)]
        [ValidateNotNull()]
        [string]$Sni,

        [Parameter(Mandatory=$false)]
        [ValidateNotNull()]
        [switch]$NoValidation,

        [Parameter(Mandatory=$false)]
        [ValidateNotNull()]
        [Int]$TimeoutSec = 10
    )

    process
    {
        # 'No Validation' callback
        $certValidation = { $true }

        # stream and client for disposal later
        $client = $null
        $stream = $null

        # Status object to report on connection, auth and cert
        $status = [PSCustomObject]@{
            AuthSuccess = $false
            Connected = $false
            Certificate = $null
            Error = [string]::Empty
        }

        try {
            # Construct TcpClient and stream to target
            Write-Verbose ("{0}: Connecting" -f $Uri)
            $client = New-Object System.Net.Sockets.TcpClient

            # Tasks for connect and timeout
            $connect = $client.ConnectAsync($Uri.Host, $Uri.Port)
            $connect.Wait($TimeoutSec * 1000) | Out-Null

            # Check if we timed out
            if (!$connect.IsCompleted)
            {
                # Connect didn't finish in time
                Write-Error ("{0}: Failed to connect" -f $Uri)
            }

            # Update status
            $status.Connected = $true

            # Configure the SslStream connection
            $stream = $null
            if ($NoValidation)
            {
                $stream = New-Object System.Net.Security.SslStream -ArgumentList $client.GetStream(), $false, $certValidation
            } else {
                $stream = New-Object System.Net.Security.SslStream -ArgumentList $client.GetStream(), $false
            }

            # This supplies the SNI to the endpoint
            Write-Verbose ("{0}: Sending SNI as {1}" -f $Uri, $Sni)
            $stream.AuthenticateAsClient($Sni)

            # Update status
            $status.AuthSuccess = $true

            # Capture the remote certificate from the stream
            Write-Verbose ("{0}: Retrieving remote certificate" -f $Uri)
            $status.Certificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::New($stream.RemoteCertificate)
        } catch {
            $status.Error = $_.ToString()
        } finally {
            if ($null -ne $stream)
            {
                $stream.Dispose()
            }

            if ($null -ne $client)
            {
                $client.Dispose()
            }
        }

        # Return status object
        $status
    }
}

<#
#>

Function Test-EndpointCertificate
{
    [CmdletBinding(DefaultParameterSetName="NoPipe")]
    param(
        [Parameter(Mandatory=$true, ValueFromPipeline, Position=0)]
        [ValidateNotNull()]
        $Connection,

        [Parameter(Mandatory=$false)]
        [ValidateNotNull()]
        [string]$Sni = "",

        [Parameter(Mandatory=$false)]
        [ValidateNotNull()]
        [Int]$ConcurrentChecks = 30,

        [Parameter(Mandatory=$false)]
        [ValidateNotNull()]
        [Int]$TimeoutSec = 10,

        [Parameter(Mandatory=$false)]
        [switch]$AsHashTable = $false
    )

    begin
    {
        # We'll verbose report on the total run time later on
        $beginTime = [DateTime]::UtcNow

        # Initial session state for the check script. This is to import functions in to the
        # creates runspaces
        $initialSessionState = [System.Management.Automation.Runspaces.InitialSessionState]::CreateDefault()

        @("Get-CertificateData", "Get-CertificateExtension") | ForEach-Object {
            $content = Get-Content Function:\$_ | Out-String
            $function = [System.Management.Automation.Runspaces.SessionStateFunctionEntry]::New($_, $content)
            $initialSessionState.Commands.Add($function)
        }

        # Use a custom object so the wait block can replace the list with a new list
        # (i.e. update the reference)
        $state = [PSCustomObject]@{
            runspaces = New-Object System.Collections.Generic.List[PSCustomObject]
            AsHashTable = $AsHashTable
        }

        # Create a list of endpoints we've scheduled for checking to avoid duplicates
        # passed in by pipeline
        $scheduled = New-Object 'System.Collections.generic.HashSet[string]'

        # Common wait block to use to process finished jobs
        # $target is the is the high count before we can schedule more checks
        $waitScript = {
            param($state, $target)

            while (($state.runspaces | Measure-Object).Count -gt $target)
            {
                # Separate tasks in to 'completed' and not
                $tempList = New-Object System.Collections.Generic.List[PSCustomObject]
                $completeList = New-Object System.Collections.Generic.List[PSCustomObject]
                $state.runspaces | ForEach-Object {
                    if ($_.Status.IsCompleted)
                    {
                        $completeList.Add($_)
                    } else {
                        $tempList.Add($_)
                    }
                }
                $state.runspaces = $tempList

                # Process completed runspaces
                $completeList | ForEach-Object {
                    $runspace = $_

                    # Try to receive the job output, being the HashTable containing
                    # the properties for the check
                    try {
                        $result = $runspace.Runspace.EndInvoke($runspace.Status) | Select-Object -First 1

                        if ($state.AsHashTable)
                        {
                            $result
                        } else {
                            [PSCustomObject]$result
                        }
                    } catch {
                        Write-Warning "Error reading return from runspace: $_"
                        Write-Warning ($_ | Format-List -property * | Out-String)
                    }

                    # Make sure we remove the runspace now
                    $runspace.Runspace.Dispose()
                    $runspace.Status = $null
                }

                Start-Sleep -Seconds 1
            }
        }
    }

    process
    {
        # Wait for job level to go under ConcurrentChecks
        Invoke-Command -Script $waitScript -ArgumentList $state, ($ConcurrentChecks-1)

        # Object representing the target of the check
        $conn = [PSCustomObject]@{
            Connection = $null
            Sni = $null
        }

        & {
            # Check if we have a Uri object
            if ($Connection.GetType().FullName -eq "System.Uri")
            {
                $conn.Connection = $Connection.AbsoluteUri.ToString()
                $conn.Sni = $Connection.Host.ToString()
                return
            }

            # If it's a HashTable, check for relevant keys
            if ($Connection.GetType().FullName -eq "System.Collections.Hashtable")
            {
                try { $conn.Connection = $Connection["Uri"].ToString() } catch {}
                try { $conn.Connection = $Connection["Connection"].ToString() } catch {}
                try { $conn.Sni = $Connection["Sni"].ToString() } catch {}

                return
            }

            # If it's a custom object, check for members
            if ($Connection.GetType().FullName -eq "System.Management.Automation.PSCustomObject")
            {
                try { $conn.Connection = $Connection.Uri.ToString() } catch {}
                try { $conn.Connection = $Connection.Connection.ToString() } catch {}
                try { $conn.Sni = $Connection.Sni.ToString() } catch {}

                return
            }

            # See if we can convert it to a uri object
            try {
                $uri = New-NormalisedUri $Connection

                # Success - Use this object
                $conn.Connection = $uri.ToString()
                $conn.Sni = $uri.Host.ToString()
                return
            } catch {
            }
        }

        # Normalise the Uri
        try {
            $conn.Connection = New-NormalisedUri $conn.Connection -AsString
        } catch {
            Write-Warning ("Could not normalise the Uri ({0}): {1}" -f $conn.Connection, $_)
            return
        }

        # Configure Sni, if there is a 'Connection' value, but no Sni
        if (![string]::IsNullOrEmpty($conn.Connection) -and [string]::IsNullOrEmpty($conn.Sni))
        {
            try {
                $conn.Sni = ([Uri]::New($conn.Connection)).Host
            }
            catch {
            }
        }

        # If SNI was provided, unconditionally set the Sni to that, regardless of
        # what has been determined above
        if (![string]::IsNullOrEmpty($Sni))
        {
            $conn.Sni = $Sni
        }

        # Make sure we have something valid to continue
        if ([string]::IsNullOrEmpty($conn.Connection) -or [string]::IsNullOrEmpty($conn.Sni))
        {
            Write-Warning ("Could not convert incoming object or invalid inputs: {0}" -f $Connection)
            return
        }

        # Check if this combination of connection and uri is already in the scheduled list
        # and don't check, if it is already present
        $key = $conn.Connection + ":" + $conn.Sni
        if ($scheduled.Contains($key))
        {
            return
        }

        $scheduled.Add($key) | Out-Null

        # Endpoint check script
        $checkScript = {
            param($Connection, $Sni, $TimeoutSec)

            $InformationPreference = "Continue"
            $ErrorActionPreference = "Stop"
            Set-StrictMode -Version 2

            # Build status object
            $status = @{
                Connection = $Connection
                Sni = $Sni
                Connected = $false
                Subject = ""
                Issuer = ""
                NotBefore = [DateTime]::MinValue
                NotAfter = [DateTime]::MinValue
                Thumbprint = ""
                LocallyTrusted = $false
                Extensions = ""
                SAN = ""
                EKU = ""
                BasicConstraints = ""
                RawData = ""
                Addresses = ""
                CertPath = ""
                ErrorMsg = ""
            }

            # Uri object for connection
            $uri = [Uri]$Connection

            try {
                # Get-CertificateData doesn't throw errors, just returns the status object
                # Attempt to connect with certificate validation on first attempt
                $connectStatus = Get-CertificateData -Uri $Connection -Sni $Sni -TimeoutSec $TimeoutSec

                # If we can't connect, just stop here
                if (!$connectStatus.Connected)
                {
                    Write-Verbose "Coult not connect to endpoint"
                    Write-Error $connectStatus.Error
                }

                $failedAuth = $false
                if (!$connectStatus.AuthSuccess -or $null -eq $connectStatus.Certificate)
                {
                    # We connected, but failed authentication or didn't receive a certificate
                    # Attempt to reconnect, but without validation of certificates
                    Write-Verbose "Validation of remote endpoint failed. Reattempting without validation."
                    $connectStatus = Get-CertificateData -Uri $Connection -Sni $Sni -TimeoutSec $TimeoutSec -NoValidation
                    $failedAuth = $true
                }

                if (!$connectStatus.AuthSuccess -or !$connectStatus.Connected -or $null -eq $connectStatus.Certificate -or ![string]::IsNullOrEmpty($connectStatus.Error))
                {
                    # Issue with connecting to the endpoint here. Can't continue
                    Write-Verbose "Endpoint connectivity or auth failure"
                    Write-Error $connectStatus.Error
                }

                $cert = $connectStatus.Certificate

                # Convert the extensions to friendly names with data
                Write-Verbose ("{0}: Unpacking certificate extensions" -f $Connection)
                try {
                    $extensions = $cert.Extensions | Where-Object { $null -ne $_ } | ForEach-Object {
                        $asndata = New-Object 'System.Security.Cryptography.AsnEncodedData' -ArgumentList $_.Oid, $_.RawData

                        $friendlyName = [string]::Empty
                        if (!([string]::IsNullOrEmpty($_.Oid.FriendlyName)))
                        {
                            $friendlyName = $_.Oid.FriendlyName
                        }

                        [PSCustomObject]@{
                            Oid = $_.Oid.Value
                            FriendlyName = $friendlyName
                            Value = $asndata.Format($false)
                        }
                    }
                } catch {
                    Write-Error "Error unpacking extensions: $_"
                }

                # Pack the extensions in to a string object
                try {
                    $extensionStr = ($extensions | ForEach-Object {
                        ("{0}({1}) = {2}{3}" -f $_.FriendlyName, $_.Oid, $_.Value, [Environment]::NewLine)
                    } | Out-String).TrimEnd([Environment]::NewLine)
                } catch {
                    Write-Error "Error transforming extensions: $_"
                }

                # Get addresses for this endpoint
                $addresses = [System.Net.DNS]::GetHostAddresses($uri.Host)

                # Build chain information for this certificate
                $chain = [System.Security.Cryptography.X509Certificates.X509Chain]::New()
                $chain.Build($cert) | Out-Null
                $certPath = ($chain.ChainElements |
                    ForEach-Object { $_.Certificate.Subject.ToString() + [Environment]::NewLine } |
                    Out-String).TrimEnd([Environment]::NewLine)

                # Update the hashtable with the entries we want to update on the CertificateInfo object
                Write-Verbose ("{0}: Updating object" -f $Connection)
                $status["Connected"] = $true
                $status["Subject"] = $cert.Subject
                $status["Issuer"] = $cert.Issuer
                $status["NotBefore"] = $cert.NotBefore.ToUniversalTime()
                $status["NotAfter"] = $cert.NotAfter.ToUniversalTime()
                $status["Thumbprint"] = $cert.Thumbprint
                $status["LocallyTrusted"] = !$failedAuth
                $status["Extensions"] = $extensionStr
                $status["SAN"] = Get-CertificateExtension -Oid "2.5.29.17" -Extensions $extensions
                $status["EKU"] = Get-CertificateExtension -Oid "2.5.29.37" -Extensions $extensions
                $status["BasicConstraints"] = Get-CertificateExtension -Oid "2.5.29.19" -Extensions $extensions
                $status["RawData"] = [System.Convert]::ToBase64String($cert.RawData)

                $addressStr = ""
                $addresses | ForEach-Object { $addressStr += ($_.ToString() + ", ") }
                $addressStr = $addressStr.TrimEnd(", ")

                $status["Addresses"] = $addressStr
                $status["CertPath"] = $certPath
                $status["ErrorMsg"] = [string]::Empty
            } catch {
                # Write-Warning ("{0}: Failed to check endpoint: {1}" -f $Connection, $_)
                $status["ErrorMsg"] = [string]$_
            }

            # Return the state object
            $status
        }

        # Schedule a run for this uri
        Write-Verbose ("Scheduling check: {0}" -f $Connection)
        $runspace = [PowerShell]::Create($initialSessionState)
        $runspace.AddScript($checkScript) | Out-Null
        $runspace.AddParameter("Connection", $conn.Connection) | Out-Null
        $runspace.AddParameter("Sni", $conn.Sni) | Out-Null
        $runspace.AddParameter("TimeoutSec", $TimeoutSec) | Out-Null

        $state.runspaces.Add([PSCustomObject]@{
            Runspace = $runspace
            Status = $runspace.BeginInvoke()
        })
    }

    end
    {
        # Wait for all runspaces to finish
        Write-Verbose "Waiting for remainder of runspaces to finish"
        Invoke-Command -Script $waitScript -ArgumentList $state, 0

        Write-Verbose ("Total runtime: {0} seconds" -f ([DateTime]::UtcNow - $beginTime).TotalSeconds)
    }
}