Private/Test-SqlCertInRootStore.ps1
|
# ============================================================================= # Script : Private/Test-SqlCertInRootStore.ps1 # Author : Keith Ramsey # Created : 2026-09-08 # ============================================================================= # A1 helper (GR-003, DR-034): is a thumbprint present in a machine's # LocalMachine\Root store? Local inline, or remote via Invoke-Command (the engine # reader's idiom). The mockable store-read seam for the client-trust commands. # ============================================================================= function Test-SqlCertInRootStore { <# .SYNOPSIS Reports whether a thumbprint is in a machine's LocalMachine\Root store. A1 helper. .DESCRIPTION Reads the target machine's trusted-root store and returns $true when a certificate with the given thumbprint is present. A local target is read inline; a remote target is read inside an Invoke-Command block (the engine reader's idiom). Read-only. .PARAMETER Thumbprint The certificate thumbprint to look for. .PARAMETER ComputerName The machine whose LocalMachine\Root to read. Default local machine. .PARAMETER Credential Credential for a remote read. .OUTPUTS System.Boolean .NOTES Steps: 1. Build the store-read scriptblock (thumbprint passed as a bound argument). 2. Run it local inline, or remote via Invoke-Command with -ComputerName / -Credential. 3. Return $true when the thumbprint is present in LocalMachine\Root. #> [CmdletBinding()] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseUsingScopeModifierInNewRunspaces', '', Justification = 'Remote Invoke-Command block receives the thumbprint via param() + -ArgumentList, not closure capture.')] [OutputType([bool])] param( [Parameter(Mandatory)] [string] $Thumbprint, [string] $ComputerName = $env:COMPUTERNAME, [PSCredential] $Credential ) # 1. Store-read scriptblock. $sb = { param($tp) [bool](Get-ChildItem Cert:\LocalMachine\Root -ErrorAction SilentlyContinue | Where-Object { $_ -and $_.Thumbprint -ieq $tp } | Select-Object -First 1) } # 2/3. Local inline or remote. if ($ComputerName -eq $env:COMPUTERNAME) { & $sb $Thumbprint } else { $ic = @{ ComputerName = $ComputerName; ScriptBlock = $sb; ArgumentList = (, $Thumbprint) } if ($Credential) { $ic.Credential = $Credential } Invoke-Command @ic } } |