使用证书扩展获取主题备用名称时出现问题

Question

我目前有这个 powershell 代码，基本上可以从 URI 获取有关证书的基本信息，并且我需要以 Powershell Native 方式执行此操作，因此我无法使用 OpenSSL 等工具，因此我将其注释掉。一切正常，但当尝试获取 SAN 时，在 powershell 中显示为空。

这是代码

[CmdletBinding()]
Param(
    [Parameter(Mandatory = $True, Position = 0)]
    [string]$uri
    #[Parameter(Mandatory = $false, Position = 1)]
    #[string]$path = 'C:\Apps\OpenSSL-Win64\bin\'
)

#if (-Not (Test-Path -Path $path)) {
#    Write-Error "OpenSSL client not found. Supply a valid OpenSSL \bin path using -path parameter"
#    return        
#}
#else {
#    $openSSL = (Join-Path -Path $path -ChildPath openssl.exe)
#}

# Disable certificate validation
[Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

# Force TLS 1.2
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# Set timeout for the web client
$timeoutMs = 10000

# Show URI being tested (passed as input parameter URI)
$endPoint = "https://{0}" -f $uri
$portString = ":443"
$server = "{0}{1}" -f $uri,$portString
Write-Host "Check $endPoint" -ForegroundColor Green

$req = [Net.HttpWebRequest]::Create($endPoint)
$req.Timeout = $timeoutMs

try {
    $req.GetResponse() | Out-Null
} 
catch {
    Write-Host "URL check error $uri`: $_" -ForegroundColor Red
}

# Retrieve certificate details
$cert = $req.ServicePoint.Certificate

$certExpDate = $cert.GetExpirationDateString()
$certName = $cert.GetName()
$certThumbprint = $cert.GetCertHashString()
$certEffectiveDate = $cert.GetEffectiveDateString()

# Retrieve SANs from the certificate's raw data
$certSANs = @()
$rawSANs = $cert.Extensions | Where-Object { $_.Oid.Value -eq "2.5.29.17" } | ForEach-Object { $_.Format($false) }
foreach ($rawSAN in $rawSANs) {
    $certSANs += ($rawSAN -split ", " | Where-Object { $_ -like "DNS:*" }).Substring(4)
}

# Construct an output string using PowerShell string formatting (-f)
$certDetails = @"
Subject: $certName
Thumbprint: $certThumbprint
Effective Date: $certEffectiveDate
Expiry Date: $certExpDate
SANs: $($certSANs -join ", ")
"@

# Output certificate details to terminal    
Write-Output $certDetails

我尝试使用证书扩展来拉出Sans，Oid值为2.5.29.17，但没有成功。我希望它能够提取 powershell 中提到的 URI 的 SANS，然后对其进行格式化。

Answer 1

根据我的经验，您从中获得的证书不会公开扩展。数据就在那里，但在这种情况下它不可用。您可以做的是将其转换为原始数据，初始化一个新的证书对象，然后导入原始数据，这样您就可以获得扩展数据，并允许您提取 SAN。

$rawcert = $req.ServicePoint.Certificate.Export('cert')
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cert.Import($rawcert)
$SANs = $cert.Extensions.where({?{$_.oid.value -eq '2.5.29.17'}).format(0) -split ', ' |?{$_ -like 'DNS*'}|%{$_ -replace '^.*?[:=]'}
$certDetails = @"
Subject: $($cert.Subject)
Thumbprint: $($cert.Thumbprint)
Effective Date: $($cert.NotBefore)
Expiry Date: $($cert.NotAfter)
SANs: $($SANs -join ", ")
"@