[英]Disable a certificate in the Root using PowerShell
使用Windows Server Core。
我想在商店根目录的文件夹中禁用证书。 我有要禁用的证书的指纹,根据下面的图片,我可以通过Windows UI进行操作。 但是我想通过Powershell做到这一点。
我找不到如何通过PowerShell禁用证书的方法,您知道吗?
注意:我对删除证书不感兴趣
如果您很好奇,这是解决此处讨论的问题的方法: https : //www.namecheap.com/support/knowledgebase/article.aspx/9774/2238/incomplete-certificate-chain-on-windows-servers
做到这一点的唯一方法是通过使用p / invoke interop并传递ASN编码的空X509 EKU扩展值(两个字节, 0x30
和0x0
)来显式禁用属性中的EKU,以调用非托管CertSetCertificateContextProperty非托管函数。
代码如下所示:
# define unmanaged function interop signatures
$signature = @"
[DllImport("Crypt32.dll", SetLastError = true, CharSet = CharSet.Auto)]
public static extern bool CertSetCertificateContextProperty(
IntPtr pCertContext,
uint dwPropId,
uint dwFlags,
IntPtr pvData
);
[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
public struct CRYPTOAPI_BLOB {
public uint cbData;
public IntPtr pbData;
}
"@
Add-Type -MemberDefinition $signature -Namespace PKI -Name Crypt32
# create empty X509 EKU extension value. Empty value literally disables all EKU
$bytes = New-Object byte[] -ArgumentList 2
$bytes[0] = 48
$bytes[1] = 0
# do unmanaged stuff
$pbData = [Runtime.InteropServices.Marshal]::AllocHGlobal(2)
[Runtime.InteropServices.Marshal]::Copy($bytes, 0, $pbData, 2)
# fill pvData structure
$blob = New-Object PKI.Crypt32+CRYPTOAPI_BLOB -Property @{
cbData = 2;
pbData = $pbData;
}
# do more unmanaged stuff
$pvData = [Runtime.InteropServices.Marshal]::AllocHGlobal([Runtime.InteropServices.Marshal]::SizeOf([type][PKI.Crypt32+CRYPTOAPI_BLOB]))
# copy data value to unmanaged memory
[Runtime.InteropServices.Marshal]::StructureToPtr($blob, $pvData, $false)
# call CertSetCertificateContextProperty function
[PKI.Crypt32]::CertSetCertificateContextProperty($Cert.Handle,9,0,$pvData)
# release unmanaged memory to prevent memory leak
[Runtime.InteropServices.Marshal]::FreeHGlobal($pbData)
[Runtime.InteropServices.Marshal]::FreeHGlobal($pvData)
请注意,函数调用需要$cert
变量中的有效X509Certificate2证书对象。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.