Private/Resolve-IDBridgeCmsCertificate.ps1
|
<# .SYNOPSIS Locate the Document Encryption certificate the Cms secrets provider encrypts with (internal). .DESCRIPTION Internal helper for the IDBridge secret vault. Resolves the certificate Set-IDBridgeSecret passes to Protect-CmsMessage: - When Secrets.Cms.Thumbprint is configured, that certificate is looked up in the LocalMachine and CurrentUser My stores. - Otherwise the stores are searched for exactly one unexpired 'CN=IDBridge Secrets' certificate with the Document Encryption EKU (as created by New-IDBridgeSecretCertificate). Throws with a pointer at New-IDBridgeSecretCertificate (none found) or at configuring Secrets.Cms.Thumbprint (ambiguous match). .EXAMPLE $cert = Resolve-IDBridgeCmsCertificate .NOTES Created by: Sam Cattanach Modified: 2026-07-01 #> function Resolve-IDBridgeCmsCertificate { [CmdletBinding()] [OutputType([System.Security.Cryptography.X509Certificates.X509Certificate2])] param () $IDConfig = Get-IDBridgeConfig $thumbprint = if ($IDConfig.Secrets -and $IDConfig.Secrets.Cms) { $IDConfig.Secrets.Cms.Thumbprint } else { $null } $stores = 'Cert:\LocalMachine\My', 'Cert:\CurrentUser\My' if ($thumbprint) { foreach ($store in $stores) { $cert = Get-Item -Path (Join-Path $store $thumbprint) -ErrorAction SilentlyContinue if ($cert) { return $cert } } Throw "The CMS certificate with thumbprint '$thumbprint' (Secrets.Cms.Thumbprint) was not found in the LocalMachine or CurrentUser My store. Create one with New-IDBridgeSecretCertificate and update the config." } # No thumbprint configured: fall back to the default subject New-IDBridgeSecretCertificate uses. $documentEncryptionOid = '1.3.6.1.4.1.311.80.1' $certs = @(foreach ($store in $stores) { Get-ChildItem -Path $store -ErrorAction SilentlyContinue | Where-Object { $_.Subject -eq 'CN=IDBridge Secrets' -and $_.NotAfter -gt (Get-Date) -and $_.EnhancedKeyUsageList.ObjectId -contains $documentEncryptionOid } }) if ($certs.Count -eq 0) { Throw "No 'CN=IDBridge Secrets' Document Encryption certificate was found. Create one with New-IDBridgeSecretCertificate, or set Secrets.Cms.Thumbprint to an existing certificate." } if ($certs.Count -gt 1) { Throw "Multiple 'CN=IDBridge Secrets' certificates were found ($(($certs.Thumbprint) -join ', ')). Set Secrets.Cms.Thumbprint in IDBridgeConfig.psd1 to pick one." } return $certs[0] } |