gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 20:53:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix certificate selection

Browse Source
This commit is contained in:
Oliver Kieselbach
2026-05-18 12:25:45 +02:00
parent bb4f663ace
commit e64b795b28
4 changed files with 26 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Agent/AutopilotMonitor.Agent.Core/Security/CertificateHelper.cs
+12 -6
View File
@@ -52,15 +52,21 @@ namespace AutopilotMonitor.Agent.Core.Security
}
else
{
// Auto-detect MDM certificate by issuer and EKU
// Auto-detect MDM certificate by issuer and EKU.
// Match ONLY "CN=Microsoft Intune MDM Device CA" — NOT
// "CN=Microsoft Intune Device Management Device CA" (MMP-C stack),
// which is co-installed on dual-enrolled devices and chains to a
// different intermediate the backend does not pin. A broader
// substring match on "Microsoft Intune" would let the MMP-C cert
// win the NotAfter tiebreaker and produce ChainFailed at the backend.
var mdmCerts = store.Certificates
.OfType<X509Certificate2>()
.Where(c =>
{
// Check issuer (Microsoft Intune MDM Device CA or similar)
var issuerContainsMdm = c.Issuer.Contains("Microsoft Intune", StringComparison.OrdinalIgnoreCase) ||
c.Issuer.Contains("MDM Device CA", StringComparison.OrdinalIgnoreCase) ||
c.Issuer.Contains("Microsoft Device CA", StringComparison.OrdinalIgnoreCase);
var issuerIsMdm = string.Equals(
c.Issuer,
"CN=Microsoft Intune MDM Device CA",
StringComparison.OrdinalIgnoreCase);
// Check Enhanced Key Usage for Client Authentication (1.3.6.1.5.5.7.3.2)
var hasClientAuth = c.Extensions
@@ -69,7 +75,7 @@ namespace AutopilotMonitor.Agent.Core.Security
.OfType<Oid>()
.Any(oid => oid.Value == "1.3.6.1.5.5.7.3.2"));
return issuerContainsMdm && hasClientAuth;
return issuerIsMdm && hasClientAuth;
})
.OrderByDescending(c => c.NotAfter) // Prefer certs with longer validity
.ToList();
src/Agent/AutopilotMonitor.Agent.V2.Core/Security/CertificateHelper.cs
+12 -6
View File
@@ -52,15 +52,21 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
}
else
{
// Auto-detect MDM certificate by issuer and EKU
// Auto-detect MDM certificate by issuer and EKU.
// Match ONLY "CN=Microsoft Intune MDM Device CA" — NOT
// "CN=Microsoft Intune Device Management Device CA" (MMP-C stack),
// which is co-installed on dual-enrolled devices and chains to a
// different intermediate the backend does not pin. A broader
// substring match on "Microsoft Intune" would let the MMP-C cert
// win the NotAfter tiebreaker and produce ChainFailed at the backend.
var mdmCerts = store.Certificates
.OfType<X509Certificate2>()
.Where(c =>
{
// Check issuer (Microsoft Intune MDM Device CA or similar)
var issuerContainsMdm = c.Issuer.Contains("Microsoft Intune", StringComparison.OrdinalIgnoreCase) ||
c.Issuer.Contains("MDM Device CA", StringComparison.OrdinalIgnoreCase) ||
c.Issuer.Contains("Microsoft Device CA", StringComparison.OrdinalIgnoreCase);
var issuerIsMdm = string.Equals(
c.Issuer,
"CN=Microsoft Intune MDM Device CA",
StringComparison.OrdinalIgnoreCase);
// Check Enhanced Key Usage for Client Authentication (1.3.6.1.5.5.7.3.2)
var hasClientAuth = c.Extensions
@@ -69,7 +75,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Security
.OfType<Oid>()
.Any(oid => oid.Value == "1.3.6.1.5.5.7.3.2"));
return issuerContainsMdm && hasClientAuth;
return issuerIsMdm && hasClientAuth;
})
.OrderByDescending(c => c.NotAfter) // Prefer certs with longer validity
.ToList();
src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
+1 -1
View File
@@ -1 +1 @@
768
770
src/Agent/AutopilotMonitor.Agent/buildcounter.txt
+1 -1
View File
@@ -1 +1 @@
1353
1354