Powershell and certificate

Question

Hello,

I would like to find how I can find information about certificate store in AD.
I can find CA Certificate here :

How can I use it to find certificate information ?

It's bytes encoded here. I would like to find what's the expiration data + algorithm used (sha1 / sha2).

Here it my powershell commandlet :
(get-item "AD:cn=ps-ca2-ca,cn=aia,cn=public key services,cn=services,$((Get-ADRootDSE).configurationNamingContext)" -properties *)
and certificate value is stored in cacertificate propertie

Thank you for your help.

Answer 1

I see you already can get byte array from cACertificate DS attribute. Then you can construct X509Certificate2 object:

$dsAIA = get-item "AD:cn=ps-ca2-ca,cn=aia,cn=public key services,cn=services,$((Get-ADRootDSE).configurationNamingContext)" -properties cACertificate
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 @(,$dsAIA.cACertificate[0])

then use $cert to access necessary certificate information.

Answer 2

[ADVERTISMENT]

If you intend to work with CAs in PowerShell, then I would recommend to use my free and open-source PowerShell PKI module.

Then fire Get-CertificationAuthority command and explore various properties, including CA certificate. There are 100+ ADCS-related cmdlets.

Answer 3

Hello, thanks a lot.
It works perfectly :)

How could I find this alone O_o ?

Syntax is not very common to what I use to play with ...

This is what I do with it :

Function Get-CAName  
{  
    $EnterpriseCA = (get-childitem "AD:\CN=Enrollment Services,CN=Public Key Services,CN=Services,$((Get-ADRootDSE).configurationNamingContext)" -property *)  
    if($null -eq $EnterpriseCA)  
    {  
        [PSCustomObject]@{  
            CAName = "<N/A>"  
            SignatureAlgorithm = "<N/A>"  
        }  
    }  
    else  
    {  
        foreach ($CA in $EnterpriseCA)  
        {   
            $CACert= New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 @(,$CA.cACertificate[0])  
            [PSCustomObject]@{  
                CAName = $CA.name  
                CAServer = $CA.dNSHostName  
                SignatureAlgorithm = $CACert.SignatureAlgorithm.FriendlyName  
                CertStartDate = $CACert.notbefore.ToString("dd/MM/yyyy")  
                CertEndDate = $CACert.notafter.ToString("dd/MM/yyyy")  
            }  
        }  
    }  
}  

And the html result :

Answer 4

Thank you for your answer and thank you for your module :)

I will not need more commandlet I think. But if I need more, I will use it :)