gsadmin/Invoke-OpenSSHConfiguration
1
0
Fork 0
mirror of https://github.com/Grace-Solutions/Invoke-OpenSSHConfiguration.git synced 2026-07-26 11:38:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix RSABCrypt to RSACng cast error in certificate PEM conversion

Browse Source 
- Wrapped CNG key casting in try/catch for both public and private key extraction
- RSABCrypt and other non-CNG implementations now gracefully skip key blob export
- Certificate PEM blob still generated correctly (only separate key blobs affected)
- Demoted public key extraction failure from Warning to Verbose (non-critical)
- Added informative message about key implementation type on failure
This commit is contained in:
GraceSolutions
2026-05-04 10:09:48 -04:00
parent 03a3912a29
commit 40de4368d7
1 changed files with 77 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Toolkit/Functions/ConvertFrom-CertificateToPEM.ps1
+27 -2
View File
@@ -588,6 +588,8 @@ Function ConvertFrom-CertificateToPEM
Switch ($Null -ine $X509Certificate2.Object.PublicKey) Switch ($Null -ine $X509Certificate2.Object.PublicKey)
{ {
{($_ -eq $True)} {($_ -eq $True)}
{
Try
{ {
Switch ($X509Certificate2.OID.FriendlyName) Switch ($X509Certificate2.OID.FriendlyName)
{ {
@@ -605,11 +607,15 @@ Function ConvertFrom-CertificateToPEM
Default Default
{ {
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - The certificate key algorithm of `"$($X509Certificate2.OID.FriendlyName)`" [OID: $($X509Certificate2.OID.Value)] is unsupported for public key extraction." $LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - The certificate key algorithm of `"$($X509Certificate2.OID.FriendlyName)`" [OID: $($X509Certificate2.OID.Value)] is unsupported for public key blob extraction."
Write-Warning -Message ($LoggingDetails.LogMessage) Write-Verbose -Message ($LoggingDetails.LogMessage)
} }
} }
Switch ($Null -ine $X509Certificate2.CNG)
{
{($_ -eq $True)}
{
$X509Certificate2.PublicKey = $X509Certificate2.CNG.Key $X509Certificate2.PublicKey = $X509Certificate2.CNG.Key
$X509Certificate2.PublicKeyEncoded = [System.Convert]::ToBase64String(($X509Certificate2.PublicKey.Export([System.Security.Cryptography.CngKeyBlobFormat]::GenericPublicBlob)), [System.Base64FormattingOptions]::InsertLineBreaks) $X509Certificate2.PublicKeyEncoded = [System.Convert]::ToBase64String(($X509Certificate2.PublicKey.Export([System.Security.Cryptography.CngKeyBlobFormat]::GenericPublicBlob)), [System.Base64FormattingOptions]::InsertLineBreaks)
@@ -620,6 +626,16 @@ Function ConvertFrom-CertificateToPEM
$OutputObjectProperties.Blobs.PublicKey = $StringBuilders.PublicKey.ToString() $OutputObjectProperties.Blobs.PublicKey = $StringBuilders.PublicKey.ToString()
} }
}
}
Catch
{
#Note: Some certificates use RSABCrypt or other non-CNG implementations that cannot be cast to RSACng/ECDsaCng.
#The certificate PEM blob is still valid - only the separate public key blob extraction fails.
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - Public key blob extraction skipped (key implementation: $($X509Certificate2.DSA.GetType().Name)). Certificate PEM is still valid."
Write-Verbose -Message ($LoggingDetails.LogMessage)
}
}
Default Default
{ {
@@ -640,6 +656,8 @@ Function ConvertFrom-CertificateToPEM
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - Attempting to extract private key (as requested by -IncludePrivateKey)..." $LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - Attempting to extract private key (as requested by -IncludePrivateKey)..."
Write-Verbose -Message ($LoggingDetails.LogMessage) Write-Verbose -Message ($LoggingDetails.LogMessage)
Try
{
Switch ($X509Certificate2.OID.FriendlyName) Switch ($X509Certificate2.OID.FriendlyName)
{ {
{($_ -iin @('RSA'))} {($_ -iin @('RSA'))}
@@ -680,6 +698,13 @@ Function ConvertFrom-CertificateToPEM
} }
} }
} }
Catch
{
#Note: Some certificates use RSABCrypt or other non-CNG implementations that cannot be cast to RSACng/ECDsaCng.
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - Private key extraction failed (key implementation: $($X509Certificate2.DSA.GetType().Name)). This key type does not support CNG export."
Write-Warning -Message ($LoggingDetails.LogMessage)
}
}
Default Default
{ {