mirror of
https://github.com/Grace-Solutions/Invoke-OpenSSHConfiguration.git
synced 2026-07-26 11:38:14 +00:00
Fix RSABCrypt to RSACng cast error in certificate PEM conversion
- Wrapped CNG key casting in try/catch for both public and private key extraction - RSABCrypt and other non-CNG implementations now gracefully skip key blob export - Certificate PEM blob still generated correctly (only separate key blobs affected) - Demoted public key extraction failure from Warning to Verbose (non-critical) - Added informative message about key implementation type on failure
This commit is contained in:
GraceSolutions
@@ -589,36 +589,52 @@ Function ConvertFrom-CertificateToPEM
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
Switch ($X509Certificate2.OID.FriendlyName)
|
||||
Try
|
||||
{
|
||||
{($_ -iin @('RSA'))}
|
||||
Switch ($X509Certificate2.OID.FriendlyName)
|
||||
{
|
||||
$X509Certificate2.DSA = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPublicKey($X509Certificate2.Object)
|
||||
$X509Certificate2.CNG = [System.Security.Cryptography.RSACNG]($X509Certificate2.DSA)
|
||||
{($_ -iin @('RSA'))}
|
||||
{
|
||||
$X509Certificate2.DSA = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPublicKey($X509Certificate2.Object)
|
||||
$X509Certificate2.CNG = [System.Security.Cryptography.RSACNG]($X509Certificate2.DSA)
|
||||
}
|
||||
|
||||
{($_ -iin @('ECC'))}
|
||||
{
|
||||
$X509Certificate2.DSA = [System.Security.Cryptography.X509Certificates.ECDSACertificateExtensions]::GetECDSAPublicKey($X509Certificate2.Object)
|
||||
$X509Certificate2.CNG = [System.Security.Cryptography.ECDSACNG]($X509Certificate2.DSA)
|
||||
}
|
||||
|
||||
Default
|
||||
{
|
||||
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - The certificate key algorithm of `"$($X509Certificate2.OID.FriendlyName)`" [OID: $($X509Certificate2.OID.Value)] is unsupported for public key blob extraction."
|
||||
Write-Verbose -Message ($LoggingDetails.LogMessage)
|
||||
}
|
||||
}
|
||||
|
||||
{($_ -iin @('ECC'))}
|
||||
Switch ($Null -ine $X509Certificate2.CNG)
|
||||
{
|
||||
$X509Certificate2.DSA = [System.Security.Cryptography.X509Certificates.ECDSACertificateExtensions]::GetECDSAPublicKey($X509Certificate2.Object)
|
||||
$X509Certificate2.CNG = [System.Security.Cryptography.ECDSACNG]($X509Certificate2.DSA)
|
||||
}
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$X509Certificate2.PublicKey = $X509Certificate2.CNG.Key
|
||||
|
||||
Default
|
||||
{
|
||||
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - The certificate key algorithm of `"$($X509Certificate2.OID.FriendlyName)`" [OID: $($X509Certificate2.OID.Value)] is unsupported for public key extraction."
|
||||
Write-Warning -Message ($LoggingDetails.LogMessage)
|
||||
$X509Certificate2.PublicKeyEncoded = [System.Convert]::ToBase64String(($X509Certificate2.PublicKey.Export([System.Security.Cryptography.CngKeyBlobFormat]::GenericPublicBlob)), [System.Base64FormattingOptions]::InsertLineBreaks)
|
||||
|
||||
$Null = $StringBuilders.PublicKey.Append('-----BEGIN PUBLIC KEY-----').AppendLine()
|
||||
$Null = $StringBuilders.PublicKey.Append($X509Certificate2.PublicKeyEncoded).AppendLine()
|
||||
$Null = $StringBuilders.PublicKey.Append('-----END PUBLIC KEY-----')
|
||||
|
||||
$OutputObjectProperties.Blobs.PublicKey = $StringBuilders.PublicKey.ToString()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$X509Certificate2.PublicKey = $X509Certificate2.CNG.Key
|
||||
|
||||
$X509Certificate2.PublicKeyEncoded = [System.Convert]::ToBase64String(($X509Certificate2.PublicKey.Export([System.Security.Cryptography.CngKeyBlobFormat]::GenericPublicBlob)), [System.Base64FormattingOptions]::InsertLineBreaks)
|
||||
|
||||
$Null = $StringBuilders.PublicKey.Append('-----BEGIN PUBLIC KEY-----').AppendLine()
|
||||
$Null = $StringBuilders.PublicKey.Append($X509Certificate2.PublicKeyEncoded).AppendLine()
|
||||
$Null = $StringBuilders.PublicKey.Append('-----END PUBLIC KEY-----')
|
||||
|
||||
$OutputObjectProperties.Blobs.PublicKey = $StringBuilders.PublicKey.ToString()
|
||||
Catch
|
||||
{
|
||||
#Note: Some certificates use RSABCrypt or other non-CNG implementations that cannot be cast to RSACng/ECDsaCng.
|
||||
#The certificate PEM blob is still valid - only the separate public key blob extraction fails.
|
||||
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - Public key blob extraction skipped (key implementation: $($X509Certificate2.DSA.GetType().Name)). Certificate PEM is still valid."
|
||||
Write-Verbose -Message ($LoggingDetails.LogMessage)
|
||||
}
|
||||
}
|
||||
|
||||
Default
|
||||
@@ -640,44 +656,53 @@ Function ConvertFrom-CertificateToPEM
|
||||
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - Attempting to extract private key (as requested by -IncludePrivateKey)..."
|
||||
Write-Verbose -Message ($LoggingDetails.LogMessage)
|
||||
|
||||
Switch ($X509Certificate2.OID.FriendlyName)
|
||||
Try
|
||||
{
|
||||
{($_ -iin @('RSA'))}
|
||||
Switch ($X509Certificate2.OID.FriendlyName)
|
||||
{
|
||||
$X509Certificate2.DSA = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($X509Certificate2.Object)
|
||||
$X509Certificate2.CNG = [System.Security.Cryptography.RSACNG]($X509Certificate2.DSA)
|
||||
{($_ -iin @('RSA'))}
|
||||
{
|
||||
$X509Certificate2.DSA = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($X509Certificate2.Object)
|
||||
$X509Certificate2.CNG = [System.Security.Cryptography.RSACNG]($X509Certificate2.DSA)
|
||||
}
|
||||
|
||||
{($_ -iin @('ECC'))}
|
||||
{
|
||||
$X509Certificate2.DSA = [System.Security.Cryptography.X509Certificates.ECDsaCertificateExtensions]::GetECDSAPrivateKey($X509Certificate2.Object)
|
||||
$X509Certificate2.CNG = [System.Security.Cryptography.ECDSACNG]($X509Certificate2.DSA)
|
||||
}
|
||||
|
||||
Default
|
||||
{
|
||||
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - The certificate key algorithm of `"$($X509Certificate2.OID.FriendlyName)`" [OID: $($X509Certificate2.OID.Value)] is unsupported for private key extraction."
|
||||
Write-Warning -Message ($LoggingDetails.LogMessage)
|
||||
}
|
||||
}
|
||||
|
||||
{($_ -iin @('ECC'))}
|
||||
Switch ($Null -ine $X509Certificate2.CNG)
|
||||
{
|
||||
$X509Certificate2.DSA = [System.Security.Cryptography.X509Certificates.ECDsaCertificateExtensions]::GetECDSAPrivateKey($X509Certificate2.Object)
|
||||
$X509Certificate2.CNG = [System.Security.Cryptography.ECDSACNG]($X509Certificate2.DSA)
|
||||
}
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$X509Certificate2.PrivateKey = $X509Certificate2.CNG.Key
|
||||
|
||||
Default
|
||||
{
|
||||
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - The certificate key algorithm of `"$($X509Certificate2.OID.FriendlyName)`" [OID: $($X509Certificate2.OID.Value)] is unsupported for private key extraction."
|
||||
Write-Warning -Message ($LoggingDetails.LogMessage)
|
||||
$X509Certificate2.PrivateKeyEncoded = [System.Convert]::ToBase64String(($X509Certificate2.PrivateKey.Export([System.Security.Cryptography.CngKeyBlobFormat]::PKCS8PrivateBlob)), [System.Base64FormattingOptions]::InsertLineBreaks)
|
||||
|
||||
$Null = $StringBuilders.PrivateKey.Append('-----BEGIN PRIVATE KEY-----').AppendLine()
|
||||
$Null = $StringBuilders.PrivateKey.Append($X509Certificate2.PrivateKeyEncoded).AppendLine()
|
||||
$Null = $StringBuilders.PrivateKey.Append('-----END PRIVATE KEY-----')
|
||||
|
||||
$OutputObjectProperties.Blobs.PrivateKey = $StringBuilders.PrivateKey.ToString()
|
||||
|
||||
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - Private key successfully extracted."
|
||||
Write-Verbose -Message ($LoggingDetails.LogMessage)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Switch ($Null -ine $X509Certificate2.CNG)
|
||||
Catch
|
||||
{
|
||||
{($_ -eq $True)}
|
||||
{
|
||||
$X509Certificate2.PrivateKey = $X509Certificate2.CNG.Key
|
||||
|
||||
$X509Certificate2.PrivateKeyEncoded = [System.Convert]::ToBase64String(($X509Certificate2.PrivateKey.Export([System.Security.Cryptography.CngKeyBlobFormat]::PKCS8PrivateBlob)), [System.Base64FormattingOptions]::InsertLineBreaks)
|
||||
|
||||
$Null = $StringBuilders.PrivateKey.Append('-----BEGIN PRIVATE KEY-----').AppendLine()
|
||||
$Null = $StringBuilders.PrivateKey.Append($X509Certificate2.PrivateKeyEncoded).AppendLine()
|
||||
$Null = $StringBuilders.PrivateKey.Append('-----END PRIVATE KEY-----')
|
||||
|
||||
$OutputObjectProperties.Blobs.PrivateKey = $StringBuilders.PrivateKey.ToString()
|
||||
|
||||
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - Private key successfully extracted."
|
||||
Write-Verbose -Message ($LoggingDetails.LogMessage)
|
||||
}
|
||||
#Note: Some certificates use RSABCrypt or other non-CNG implementations that cannot be cast to RSACng/ECDsaCng.
|
||||
$LoggingDetails.LogMessage = "$($GetCurrentDateTimeMessageFormat.Invoke()) - Private key extraction failed (key implementation: $($X509Certificate2.DSA.GetType().Name)). This key type does not support CNG export."
|
||||
Write-Warning -Message ($LoggingDetails.LogMessage)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user