Manage-TrustedPublisher.psm1
|
# # Created by: lucas.cueff[at]lucas-cueff.com # # v0.1 : # Released on: 02/2018 # #'(c) 2018 lucas-cueff.com - Distributed under Artistic Licence 2.0 (https://opensource.org/licenses/artistic-license-2.0).' Function Import-TrustedPublisherCert { <# .SYNOPSIS import a certificate file in the trusted publisher container of the local machine certificate store .DESCRIPTION import a certificate file in the trusted publisher container of the local machine certificate store .PARAMETER certfile Mandatory parameter -certfile certfile{full file path to a valid CER file} .OUTPUTS TypeName : System.Security.Cryptography.X509Certificates.X509Certificate2 Name MemberType Definition ---- ---------- ---------- Dispose Method void Dispose(), void IDisposable.Dispose() Equals Method bool Equals(System.Object obj), bool Equals(X509Certificate other) Export Method byte[] Export(System.Security.Cryptography.X509Certificates.X509Conte... GetCertHash Method byte[] GetCertHash() GetCertHashString Method string GetCertHashString() GetEffectiveDateString Method string GetEffectiveDateString() GetExpirationDateString Method string GetExpirationDateString() GetFormat Method string GetFormat() GetHashCode Method int GetHashCode() GetIssuerName Method string GetIssuerName() GetKeyAlgorithm Method string GetKeyAlgorithm() GetKeyAlgorithmParameters Method byte[] GetKeyAlgorithmParameters() GetKeyAlgorithmParametersString Method string GetKeyAlgorithmParametersString() GetName Method string GetName() GetNameInfo Method string GetNameInfo(System.Security.Cryptography.X509Certificates.X509... GetObjectData Method void ISerializable.GetObjectData(System.Runtime.Serialization.Seriali... GetPublicKey Method byte[] GetPublicKey() GetPublicKeyString Method string GetPublicKeyString() GetRawCertData Method byte[] GetRawCertData() GetRawCertDataString Method string GetRawCertDataString() GetSerialNumber Method byte[] GetSerialNumber() GetSerialNumberString Method string GetSerialNumberString() GetType Method type GetType() Import Method void Import(byte[] rawData), void Import(byte[] rawData, string passw... OnDeserialization Method void IDeserializationCallback.OnDeserialization(System.Object sender) Reset Method void Reset() ToString Method string ToString(), string ToString(bool verbose) Verify Method bool Verify() Archived Property bool Archived {get;set;} Extensions Property System.Security.Cryptography.X509Certificates.X509ExtensionCollection... FriendlyName Property string FriendlyName {get;set;} Handle Property System.IntPtr Handle {get;} HasPrivateKey Property bool HasPrivateKey {get;} Issuer Property string Issuer {get;} IssuerName Property X500DistinguishedName IssuerName {get;} NotAfter Property datetime NotAfter {get;} NotBefore Property datetime NotBefore {get;} PrivateKey Property System.Security.Cryptography.AsymmetricAlgorithm PrivateKey {get;set;} PublicKey Property System.Security.Cryptography.X509Certificates.PublicKey PublicKey {get;} RawData Property byte[] RawData {get;} SerialNumber Property string SerialNumber {get;} SignatureAlgorithm Property System.Security.Cryptography.Oid SignatureAlgorithm {get;} Subject Property string Subject {get;} SubjectName Property X500DistinguishedName SubjectName {get;} Thumbprint Property string Thumbprint {get;} Version Property int Version {get;} DnsNameList ScriptProperty System.Object DnsNameList {get=,(new-object Microsoft.Powershell.Comm... EnhancedKeyUsageList ScriptProperty System.Object EnhancedKeyUsageList {get=,(new-object Microsoft.Powers... SendAsTrustedIssuer ScriptProperty System.Object SendAsTrustedIssuer {get=[Microsoft.Powershell.Commands... .EXAMPLE add certificatessign.cer to the Trusted Publisher container of the local machine certificate store C:\PS> Import-TrustedPublisherCert -certfile "c:\test\certificatessign.cer" #> [CmdletBinding()] Param( [parameter(Mandatory=$true)] [ValidatePattern('^[a-zA-Z]:\\(((?![<>:"/\\|?*]).)+((?<![ .])\\)?)*$')] [String]$certfile ) try { $CertStore = New-Object System.Security.Cryptography.X509Certificates.X509Store -ArgumentList "TrustedPublisher", "LocalMachine" $CertStore.Open('ReadWrite') } catch { write-warning "Not able to open Trusted Publisher certificate container" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } try { if (test-path $certfile) { $tmpobcert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2 $tmpobcert.Import($certfile) } } catch { write-warning "Not able to read certificate provided" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } try { $CertStore.add($tmpobcert) } catch { write-warning "Not able to add the certificate provided to the local trusted publisher container" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } try { $CertStore.close() | out-null } catch { write-warning "Not able to close local certificate store" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } return $tmpobcert } Function Remove-TrustedPublisherCert { <# .SYNOPSIS Remove a certificate from the trusted publisher container of the local machine certificate store .DESCRIPTION Remove a certificate from the trusted publisher container of the local machine certificate store .PARAMETER certfile -certfile certfile{full file path to a valid CER file} .PARAMETER thumbprint -thumbprint string{valid thumbprint of a certificate already installed in the trusted published container} .OUTPUTS TypeName : System.Security.Cryptography.X509Certificates.X509Certificate2 Name MemberType Definition ---- ---------- ---------- Dispose Method void Dispose(), void IDisposable.Dispose() Equals Method bool Equals(System.Object obj), bool Equals(X509Certificate other) Export Method byte[] Export(System.Security.Cryptography.X509Certificates.X509Conte... GetCertHash Method byte[] GetCertHash() GetCertHashString Method string GetCertHashString() GetEffectiveDateString Method string GetEffectiveDateString() GetExpirationDateString Method string GetExpirationDateString() GetFormat Method string GetFormat() GetHashCode Method int GetHashCode() GetIssuerName Method string GetIssuerName() GetKeyAlgorithm Method string GetKeyAlgorithm() GetKeyAlgorithmParameters Method byte[] GetKeyAlgorithmParameters() GetKeyAlgorithmParametersString Method string GetKeyAlgorithmParametersString() GetName Method string GetName() GetNameInfo Method string GetNameInfo(System.Security.Cryptography.X509Certificates.X509... GetObjectData Method void ISerializable.GetObjectData(System.Runtime.Serialization.Seriali... GetPublicKey Method byte[] GetPublicKey() GetPublicKeyString Method string GetPublicKeyString() GetRawCertData Method byte[] GetRawCertData() GetRawCertDataString Method string GetRawCertDataString() GetSerialNumber Method byte[] GetSerialNumber() GetSerialNumberString Method string GetSerialNumberString() GetType Method type GetType() Import Method void Import(byte[] rawData), void Import(byte[] rawData, string passw... OnDeserialization Method void IDeserializationCallback.OnDeserialization(System.Object sender) Reset Method void Reset() ToString Method string ToString(), string ToString(bool verbose) Verify Method bool Verify() Archived Property bool Archived {get;set;} Extensions Property System.Security.Cryptography.X509Certificates.X509ExtensionCollection... FriendlyName Property string FriendlyName {get;set;} Handle Property System.IntPtr Handle {get;} HasPrivateKey Property bool HasPrivateKey {get;} Issuer Property string Issuer {get;} IssuerName Property X500DistinguishedName IssuerName {get;} NotAfter Property datetime NotAfter {get;} NotBefore Property datetime NotBefore {get;} PrivateKey Property System.Security.Cryptography.AsymmetricAlgorithm PrivateKey {get;set;} PublicKey Property System.Security.Cryptography.X509Certificates.PublicKey PublicKey {get;} RawData Property byte[] RawData {get;} SerialNumber Property string SerialNumber {get;} SignatureAlgorithm Property System.Security.Cryptography.Oid SignatureAlgorithm {get;} Subject Property string Subject {get;} SubjectName Property X500DistinguishedName SubjectName {get;} Thumbprint Property string Thumbprint {get;} Version Property int Version {get;} DnsNameList ScriptProperty System.Object DnsNameList {get=,(new-object Microsoft.Powershell.Comm... EnhancedKeyUsageList ScriptProperty System.Object EnhancedKeyUsageList {get=,(new-object Microsoft.Powers... SendAsTrustedIssuer ScriptProperty System.Object SendAsTrustedIssuer {get=[Microsoft.Powershell.Commands... .EXAMPLE Remove certificatessign.cer from the Trusted Publisher container of the local machine certificate store C:\PS> Remove-TrustedPublisherCert -certfile "c:\test\certificatessign.cer" .EXAMPLE remove certificate with thumprint xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx from the Trusted Publisher container of local machine certificate store C:\PS> Check-TrustedPublisherCert -thumbprint "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" #> [CmdletBinding()] Param( [parameter(Mandatory=$false)] [ValidatePattern('^[a-zA-Z]:\\(((?![<>:"/\\|?*]).)+((?<![ .])\\)?)*$')] [String]$certfile, [parameter(Mandatory=$false)] [String]$thumbprint ) If ($thumbprint -or $certfile) { try { $CertStore = New-Object System.Security.Cryptography.X509Certificates.X509Store -ArgumentList "TrustedPublisher", "LocalMachine" $CertStore.Open('ReadWrite') } catch { write-warning "Not able to open Trusted Publisher certificate container" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } if ($certfile) { try { if (test-path $certfile) { $tmpobcert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2 $tmpobcert.Import($certfile) } } catch { write-warning "Not able to read certificate provided" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } } Else { try { $tempcert = $CertStore.Certificates | Where-Object {$_.Thumbprint -eq $thumbprint} if ($tempcert) { $tmpobcert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2 $tempcert } } catch { write-warning "Not able to read certificate found from thumbprint provided" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } } try { $CertStore.Remove($tmpobcert) } catch { write-warning "Not able to delete the certificate provided to the local trusted publisher container" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } try { $CertStore.close() | out-null } catch { write-warning "Not able to close local certificate store" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } return $tmpobcert } } function Check-TrustedPublisherCert { <# .SYNOPSIS check if a certificate is installed in the trusted publisher container of the local machine certificate store .DESCRIPTION check if a certificate is installed in the trusted publisher container of the local machine certificate store .PARAMETER certfile -certfile certfile{full file path to a valid CER file} .PARAMETER thumbprint -thumbprint string{valid thumbprint of a certificate already installed in the trusted published container} .OUTPUTS TypeName : boolean .EXAMPLE check if certificatessign.cer is already added in Trusted Publisher container of local machine certificate store C:\PS> Check-TrustedPublisherCert -certfile "c:\test\certificatessign.cer" .EXAMPLE check if certificate with thumprint xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx is already added in Trusted Publisher container of local machine certificate store C:\PS> Check-TrustedPublisherCert -thumbprint "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" #> [CmdletBinding()] Param( [parameter(Mandatory=$false)] [ValidatePattern('^[a-zA-Z]:\\(((?![<>:"/\\|?*]).)+((?<![ .])\\)?)*$')] [String]$certfile, [parameter(Mandatory=$false)] [String]$thumbprint ) If ($thumbprint -or $certfile) { try { $CertStore = New-Object System.Security.Cryptography.X509Certificates.X509Store -ArgumentList "TrustedPublisher", "LocalMachine" $CertStore.Open('ReadOnly') } catch { write-warning "Not able to open Trusted Publisher certificate container" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } if ($certfile) { try { if (test-path $certfile) { $tmpobcert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2 $tmpobcert.Import($certfile) $thumbprint = $tmpobcert.Thumbprint } } catch { write-warning "Not able to read certificate provided" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } } return $CertStore.Certificates.thumbprint -contains $thumbprint try { $CertStore.close() | out-null } catch { write-warning "Not able to close local certificate store" write-error "Error Type: $($_.Exception.GetType().FullName)" write-error "Error Message: $($_.Exception.Message)" return } } } Export-ModuleMember -Function Import-TrustedPublisherCert,Check-TrustedPublisherCert,Remove-TrustedPublisherCert |