Private/Get-CwCertRole.ps1
|
function Get-CwCertRole { <# .SYNOPSIS Classifies a certificate into an operational role (CA/LDAPS/RDP/IIS/Client/...). .DESCRIPTION Role classification is driven by EKU OIDs, the certificate template name and machine context (domain controller or not): CA - basic constraints CA=true RDP - Remote Desktop Authentication EKU 1.3.6.1.4.1.311.54.1.2 or a RemoteDesktop* template LDAPS - Kerberos Authentication EKU 1.3.6.1.5.2.3.5, a DomainController* / KerberosAuthentication template, or Server Authentication EKU on a domain controller IIS - Server Authentication EKU 1.3.6.1.5.5.7.3.1 (non-DC) Client - Client Authentication 1.3.6.1.5.5.7.3.2 or Smartcard Logon 1.3.6.1.4.1.311.20.2.2 CodeSigning - Code Signing EKU 1.3.6.1.5.5.7.3.3 Other - anything else (including certs without EKU extension) #> [CmdletBinding()] [OutputType([string])] param( [AllowEmptyCollection()] [AllowNull()] [string[]]$EkuOids = @(), [bool]$IsCa = $false, [bool]$IsDomainController = $false, [AllowEmptyString()] [AllowNull()] [string]$TemplateName = '' ) if ($null -eq $EkuOids) { $EkuOids = @() } if ($null -eq $TemplateName) { $TemplateName = '' } if ($IsCa) { return 'CA' } if ($EkuOids -contains '1.3.6.1.4.1.311.54.1.2' -or $TemplateName -like 'RemoteDesktop*') { return 'RDP' } $isDcTemplate = $TemplateName -like 'DomainController*' -or $TemplateName -like 'KerberosAuthentication*' if ($EkuOids -contains '1.3.6.1.5.2.3.5' -or $isDcTemplate) { return 'LDAPS' } if ($EkuOids -contains '1.3.6.1.5.5.7.3.1') { if ($IsDomainController) { return 'LDAPS' } return 'IIS' } if ($EkuOids -contains '1.3.6.1.5.5.7.3.2' -or $EkuOids -contains '1.3.6.1.4.1.311.20.2.2') { return 'Client' } if ($EkuOids -contains '1.3.6.1.5.5.7.3.3') { return 'CodeSigning' } return 'Other' } |