通过PowerShell中的“证书模板名称”识别证书

Question

我需要使用PowerShell脚本来选择“证书模板名称”作为“机器”的证书。在certmgr.msc中，它具有值为“计算机”的“证书模板”。在“详细信息”中，同一个“证书模板名称”为“机器”。

如何在PowerShell脚本中使用这些值中的任何一个？

到目前为止，我有：

get-childitem cert:\localmachine\my | where-object {$_.} 

我已经试过几乎所有的智能感知负荷的方法，但一直没能找到任何符合我的需要。

谢谢你，

Answer 1

试试这个PowerShell的模块CertificatePS。里面有这个cmdlet Get-CertificateTemplate，正是你所需要的。我开发了它并自己使用它来区分机器和Web模板证书。

这是使用的一个例子，虽然也有其他可能性如添加PSNoteProperty到每个返回对象

# With Select-Object 
Get-ChildItem "Cert:\LocalMachine\My" | Select-Object Name,Thumbprint,@{Name="Template";Expression={Get-CertificateTemplate $_}} 

# With Where-Object 
Get-ChildItem "Cert:\LocalMachine\My" | Where-Object {Get-CertificateTemplate $_ -eq "Template"}} 

退房了解这个模块here更多的例子。

该模块并不完美，所以如果您有任何意见或建议，请在github project上这样做。

Answer 2

这里是一个天然的PowerShell的解决方案：

感谢转到PowerShell Gallery

<# 
.SYNOPSIS 
Outputs an object consisting of the template name (Template), an OID (OID), the minor version (MinorVersion), and the major version (MajorVersion). 

.DESCRIPTION 
Outputs an object consisting of the template name (Template), an OID (OID), the minor version (MinorVersion), and the major version (MajorVersion). 
This information is derived from the Certificate Extensions. 

.PARAMETER Certificate 
A X509Certificate2 object 

.EXAMPLE 
Get-ChildItem "Cert:\LocalMachine\My" | Get-CertificateTemplate 

.EXAMPLE 
Get-ChildItem "Cert:\LocalMachine\My" | Select-Object Name,Thumbprint,@{Name="Template";Expression={Get-CertificateTemplate $_}} 

.INPUTS 
Any X509Certificate2 object 

.OUTPUTS 
[PSCustomObject] @{Template=<template name; OID=<oid string>; MajorVersion=<major version num>; MinorVersion=<minor version num> } 
#> 
function Get-CertificateTemplate { 
    [CmdletBinding(SupportsShouldProcess=$false)] 
    [OutputType([string])] 
    Param([Parameter(Mandatory=$true, ValueFromPipeline=$true)] [ValidateNotNull()] [Security.Cryptography.X509Certificates.X509Certificate2]$Certificate) 

    Process { 
    $regExPrimary=[System.Text.RegularExpressions.Regex]::new("Template=([\w\s\d\.]+)\(((?:\d+.)+)\), Major Version Number=(\d+), Minor Version Number=(\d+)",[System.Text.RegularExpressions.RegexOptions]::None) 
    $regExSecondary=[System.Text.RegularExpressions.Regex]::new("Template=((?:\d+.)+), Major Version Number=(\d+), Minor Version Number=(\d+)",[System.Text.RegularExpressions.RegexOptions]::None) 

    $temp = $Certificate.Extensions | Where-Object { $_.Oid.FriendlyName -eq "Certificate Template Name" } 
    if ($temp -eq $null) { 
     Write-Verbose "Did not find 'Certificate Template Name' extension" 
     $temp=$Certificate.Extensions | Where-Object { $_.Oid.Value -eq "1.3.6.1.4.1.311.21.7" } 
    } 
    else { Write-Verbose "Found 'Certificate Template Name' extension" } 

    $Matches=$regExPrimary.Matches($temp.Format($false)) 
    if ($Matches.Count -gt 0) { 
     [email protected]{Template=$Matches[0].Groups[1].Value; OID=$Matches[0].Groups[2].Value; 
       MajorVersion=$Matches[0].Groups[3].Value; MinorVersion=$Matches[0].Groups[4].Value; 
       Thumbprint=$Certificate.Thumbprint } 
    } 
    else { 
     $Matches=$regExSecondary.Matches($temp.Format($false)) 
     if ($Matches.Count -gt 0) { 
     Write-Verbose "Found certificate without a valid Template Name" 
     [email protected]{Template=$Matches[0].Groups[1].Value; OID=$Matches[0].Groups[1].Value; 
        MajorVersion=$Matches[0].Groups[2].Value; MinorVersion=$Matches[0].Groups[3].Value; 
        Thumbprint=$Certificate.Thumbprint } 

     } 
     else { 
     Write-Verbose "Found root certificate" 
     [email protected]{Template="Root Certificate"; OID=""; MajorVersion=""; MinorVersion=""; Thumbprint=$Certificate.Thumbprint } 
     } 
    } 
    return [PSCustomObject]$object 
    } 
} 

Answer 3

下面是一个解决方案SANS模块：

Get-ChildItem Cert:\LocalMachine\my | Where-Object{$_.Extensions | Where-Object{$_.oid.friendlyname -match "Template" -and $_.format(0) -match "Machine"}}