使用 PowerShell 设置具有特定启用目的的 CA 证书

问题描述 投票：0回答：2

如何使用 PowerShell 以编程方式更改相关 Windows 证书存储中证书颁发机构的启用用途？

这可以在 证书 MMC 管理单元

中完成

这只能根据 StackOverflow：如何设置证书用途使用 P/Invoke 和 

CertSetCertificateContextProperty 实现吗？ {C#}


理想情况下，我想导入自定义受信任的根证书颁发机构，并且仅出于客户端身份验证的目的启用它。

    


powershell

pki

certificate-authority

certificate-store


2个回答




    
    
    

        

            

                

                    
2
投票

                    

                

            

        

        


一个 PowerShell Cmdlet，其核心使用 
CertSetCertificateContextProperty
。感谢 Crypt32 以及他们在另一篇文章中的回答提供指导。


用法示例：


Set-CertificateEku -StoreLocation 'CurrentUser' -StoreName 'Root' -CertificateThumbprint 'ffffffffffffffffffffffffffffffffffffffff' -Oids @("1.3.6.1.5.5.7.3.2") # Client Authentication



Function Set-CertificateEku {
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory)]
        [ValidateSet('CurrentUser', 'LocalMachine')]
        $StoreLocation,
        
        [Parameter(Mandatory)]
        $StoreName,

        [Parameter(Mandatory)]
        $CertificateThumbprint,

        [Parameter(Mandatory)]
        $Oids
    )
    $StoreLocation = switch($StoreLocation) {
        'CurrentUser' {
            [System.Security.Cryptography.X509Certificates.StoreLocation]::CurrentUser
        }
        'LocalMachine' {
            [System.Security.Cryptography.X509Certificates.StoreLocation]::LocalMachine
        }
    }
    try {
        $CertificateStore = [System.Security.Cryptography.X509Certificates.X509Store]::new($StoreName, $StoreLocation)
        $CertificateStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite -bor [System.Security.Cryptography.X509Certificates.OpenFlags]::OpenExistingOnly)
    } catch {
        Write-Error "Could not Open Certificate Store $StoreName in $StoreLocation"
        return $false
    }
    $Certificates = $CertificateStore.Certificates.Find(
        [System.Security.Cryptography.X509Certificates.X509FindType]::FindByThumbprint,
        $CertificateThumbprint,
        $false
    )
    if($Certificates.Count -eq 0) {
        Write-Error "Could not find Certificate $CertificateThumbprint in $StoreName in $StoreLocation"
        return $false
    }
    $Certificate = $Certificates[0]
    

    $PKICrypt32 = @"
    [DllImport("Crypt32.dll", SetLastError = true, CharSet = CharSet.Auto)]
    public static extern bool CertSetCertificateContextProperty(
        IntPtr pCertContext,
        uint dwPropId,
        uint dwFlags,
        IntPtr pvData
    );
    [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
    public struct CRYPTOAPI_BLOB {
        public uint cbData;
        public IntPtr pbData;
    }
"@
    Add-Type -MemberDefinition $PKICrypt32 -Namespace 'PKI' -Name 'Crypt32'

    $OIDs = [Security.Cryptography.OidCollection]::new()
    foreach($Oid in $Oids) {
        [void]$OIDs.Add([Security.Cryptography.Oid]::new($Oid))
    }
    $EKU = [Security.Cryptography.X509Certificates.X509EnhancedKeyUsageExtension]::new($OIDs, $false)
    $pbData = [Runtime.InteropServices.Marshal]::AllocHGlobal($EKU.RawData.Length)
    [Runtime.InteropServices.Marshal]::Copy($EKU.RawData, 0, $pbData, $EKU.RawData.Length)

    $Blob = New-Object PKI.Crypt32+CRYPTOAPI_BLOB -Property @{
        cbData = $EKU.RawData.Length;
        pbData = $pbData;
    }
    $pvData = [Runtime.InteropServices.Marshal]::AllocHGlobal([Runtime.InteropServices.Marshal]::SizeOf([type][PKI.Crypt32+CRYPTOAPI_BLOB]))
    [Runtime.InteropServices.Marshal]::StructureToPtr($Blob, $pvData, $false)

    $Result = [PKI.Crypt32]::CertSetCertificateContextProperty($Certificate.Handle, 9, 0, $pvData)
    [Runtime.InteropServices.Marshal]::FreeHGlobal($pvData)
    [Runtime.InteropServices.Marshal]::FreeHGlobal($pbData)
    $CertificateStore.Close()
    return $Result
}


    

    

    
    
    

    

        

            

                

                    
0
投票

                    
                

            

        

        


Vjz 的答案几乎完全完美，但他/她的代码中有一个错误，导致其无法正常运行。


行：$OIDs = [Security.Cryptography.OidCollection]::new()


无意中清除了输入参数（也称为 OID）


Function Set-CertificateEku {
[CmdletBinding()]
Param(
    [Parameter(Mandatory)]
    [ValidateSet('CurrentUser', 'LocalMachine')]
    $StoreLocation,
    
    [Parameter(Mandatory)]
    $StoreName,

    [Parameter(Mandatory)]
    $CertificateThumbprint,

    [Parameter(Mandatory)]
    $OidArray
)
$StoreLocation = switch($StoreLocation) {
    'CurrentUser' {
        [System.Security.Cryptography.X509Certificates.StoreLocation]::CurrentUser
    }
    'LocalMachine' {
        [System.Security.Cryptography.X509Certificates.StoreLocation]::LocalMachine
    }
}
try {
    $CertificateStore = [System.Security.Cryptography.X509Certificates.X509Store]::new($StoreName, $StoreLocation)
    $CertificateStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite -bor [System.Security.Cryptography.X509Certificates.OpenFlags]::OpenExistingOnly)
} catch {
    Write-Error "Could not Open Certificate Store $StoreName in $StoreLocation"
    return $false
}
$Certificates = $CertificateStore.Certificates.Find(
    [System.Security.Cryptography.X509Certificates.X509FindType]::FindByThumbprint,
    $CertificateThumbprint,
    $false
)
if($Certificates.Count -eq 0) {
    Write-Error "Could not find Certificate $CertificateThumbprint in $StoreName in $StoreLocation"
    return $false
}
$Certificate = $Certificates[0]

$PKICrypt32 = @"
[DllImport("Crypt32.dll", SetLastError = true, CharSet = CharSet.Auto)]
public static extern bool CertSetCertificateContextProperty(
    IntPtr pCertContext,
    uint dwPropId,
    uint dwFlags,
    IntPtr pvData
);
[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
public struct CRYPTOAPI_BLOB {
    public uint cbData;
    public IntPtr pbData;
}



“@
添加类型 -MemberDefinition $PKICrypt32 -命名空间 'PKI' -名称 'Crypt32'


$OID = [Security.Cryptography.OidCollection]::new()


写入主机$CertificateThumbprint


foreach（$OidArray 中的 $Oid）{


    [void]$OIDs.Add([Security.Cryptography.Oid]::new($Oid))
}


$EKU = [Security.Cryptography.X509Certificates.X509EnhancedKeyUsageExtension]::new($OIDs, $false)
$pbData = [Runtime.InteropServices.Marshal]::AllocHGlobal($EKU.RawData.Length)
[Runtime.InteropServices.Marshal]::Copy($EKU.RawData, 0, $pbData, $EKU.RawData.Length)

$Blob = New-Object PKI.Crypt32+CRYPTOAPI_BLOB -Property @{
    cbData = $EKU.RawData.Length;
    pbData = $pbData;
}
$pvData = [Runtime.InteropServices.Marshal]::AllocHGlobal([Runtime.InteropServices.Marshal]::SizeOf([type][PKI.Crypt32+CRYPTOAPI_BLOB]))
[Runtime.InteropServices.Marshal]::StructureToPtr($Blob, $pvData, $false)

$Result = [PKI.Crypt32]::CertSetCertificateContextProperty($Certificate.Handle, 9, 0, $pvData)
[Runtime.InteropServices.Marshal]::FreeHGlobal($pvData)
[Runtime.InteropServices.Marshal]::FreeHGlobal($pbData)
$CertificateStore.Close()
return $Result



}


Set-CertificateEku -StoreLocation 'LocalMachine' -StoreName 'My' -CertificateThumbprint 'ffffffffffffffffff' -OidArray @("1.3.6.1.5.5.7.3.1") # 服务器身份验证

    

    

    


  

  

    
最新问题


  





  

    © www.soinside.com 2019 - 2024. All rights reserved.