Private/Config/Test-PukCertificate.ps1
|
function Test-PukCertificate { [CmdletBinding()] [OutputType([System.Security.Cryptography.X509Certificates.X509Certificate2])] param( [Parameter(Mandatory)] [string]$Thumbprint, [ValidateSet('CurrentUser', 'LocalMachine')] [string]$StoreLocation = 'CurrentUser', [string[]]$RequiredEkuOids = @('2.5.29.37', '1.3.6.1.4.1.311.80.1') ) $storePath = "Cert:\$StoreLocation\My" $certificate = Get-ChildItem -Path $storePath -ErrorAction SilentlyContinue | Where-Object { $_.Thumbprint -eq $Thumbprint } if (-not $certificate) { throw "No certificate with thumbprint '$Thumbprint' was found in '$storePath'." } $ekuExtensionOid = '2.5.29.37' $ekuExtension = $certificate.Extensions | Where-Object { $_.Oid.Value -eq $ekuExtensionOid } $requiredPurposeOids = @($RequiredEkuOids | Where-Object { $_ -ne $ekuExtensionOid }) if ($RequiredEkuOids -contains $ekuExtensionOid -and -not $ekuExtension) { throw "Certificate '$Thumbprint' does not have an Enhanced Key Usage extension ($ekuExtensionOid)." } if ($requiredPurposeOids.Count -gt 0) { if (-not $ekuExtension) { throw "Certificate '$Thumbprint' does not have an Enhanced Key Usage extension, so required purpose OID(s) $($requiredPurposeOids -join ', ') cannot be present." } $certificatePurposeOids = @($ekuExtension.EnhancedKeyUsages | ForEach-Object { $_.Value }) $missingOids = @($requiredPurposeOids | Where-Object { $_ -notin $certificatePurposeOids }) if ($missingOids.Count -gt 0) { throw "Certificate '$Thumbprint' is missing required Enhanced Key Usage OID(s): $($missingOids -join ', ')." } } return $certificate } |