| | | 1 | | <# |
| | | 2 | | .SYNOPSIS |
| | | 3 | | Validates a certificate’s chain, EKU, and cryptographic strength. |
| | | 4 | | .DESCRIPTION |
| | | 5 | | This function checks the validity of a given X509Certificate2 object by verifying its certificate chain, |
| | | 6 | | enhanced key usage (EKU), and cryptographic strength. It can also check for self-signed certificates and |
| | | 7 | | validate against expected purposes. |
| | | 8 | | .PARAMETER Certificate |
| | | 9 | | The X509Certificate2 object to validate. |
| | | 10 | | .PARAMETER CheckRevocation |
| | | 11 | | Indicates whether to check the certificate's revocation status. |
| | | 12 | | .PARAMETER AllowWeakAlgorithms |
| | | 13 | | Indicates whether to allow weak cryptographic algorithms. |
| | | 14 | | .PARAMETER DenySelfSigned |
| | | 15 | | Indicates whether to deny self-signed certificates. |
| | | 16 | | .PARAMETER ExpectedPurpose |
| | | 17 | | The expected purposes (OID) for the certificate. |
| | | 18 | | If specified, the certificate will be validated against these purposes. |
| | | 19 | | .PARAMETER StrictPurpose |
| | | 20 | | Indicates whether to enforce strict matching of the expected purposes. |
| | | 21 | | .EXAMPLE |
| | | 22 | | Test-KestrunCertificate -Certificate $cert -DenySelfSigned -CheckRevocation |
| | | 23 | | .EXAMPLE |
| | | 24 | | Test-KestrunCertificate -Certificate $cert -AllowWeakAlgorithms -ExpectedPurpose '1.3.6.1.5.5.7.3.1' |
| | | 25 | | .EXAMPLE |
| | | 26 | | Test-KestrunCertificate -Certificate $cert -StrictPurpose |
| | | 27 | | If specified, the certificate will be validated against these purposes. |
| | | 28 | | .NOTES |
| | | 29 | | This function is designed to be used in the context of Kestrun's certificate management. |
| | | 30 | | It leverages the Kestrun.Certificates.CertificateManager for validation. |
| | | 31 | | #> |
| | | 32 | | function Test-KrCertificate { |
| | | 33 | | [KestrunRuntimeApi('Everywhere')] |
| | | 34 | | [CmdletBinding()] |
| | | 35 | | [OutputType([bool])] |
| | | 36 | | param( |
| | | 37 | | [Parameter(Mandatory)] |
| | | 38 | | [System.Security.Cryptography.X509Certificates.X509Certificate2] $Certificate, |
| | | 39 | | |
| | | 40 | | [switch] $CheckRevocation, |
| | | 41 | | [switch] $AllowWeakAlgorithms, |
| | | 42 | | [switch] $DenySelfSigned, |
| | | 43 | | |
| | | 44 | | [string[]] $ExpectedPurpose, |
| | | 45 | | [switch] $StrictPurpose |
| | | 46 | | ) |
| | | 47 | | |
| | 1 | 48 | | $oidColl = if ($ExpectedPurpose) { |
| | 0 | 49 | | $oc = [System.Security.Cryptography.OidCollection]::new() |
| | 0 | 50 | | foreach ($p in $ExpectedPurpose) { $oc.Add([System.Security.Cryptography.Oid]::new($p)) } |
| | 0 | 51 | | $oc |
| | 1 | 52 | | } else { $null } |
| | | 53 | | |
| | 1 | 54 | | return [Kestrun.Certificates.CertificateManager]::Validate($Certificate, |
| | | 55 | | $CheckRevocation.IsPresent, |
| | | 56 | | $AllowWeakAlgorithms.IsPresent, |
| | | 57 | | $DenySelfSigned.IsPresent, |
| | | 58 | | $oidColl, |
| | | 59 | | $StrictPurpose.IsPresent) |
| | | 60 | | } |
| | | 61 | | |