使用Powershell检索x509证书“Description”属性

嗯,在发帖时,两条评论都不正确,也没有任何相关性。说明不是X.509证书对象的一部分,它是特定于供应商(当前为Microsoft)的附加属性。该属性通过证书存储附加,不存在于证书存储之外。

也不是PowerShell也不是。NET提供了从证书中读取存储附加属性的本机方法(不过,也可以使用友好名称之类的内容)。相反,你需要打电话 CertGetCertificateContextProperty 通过p/invoke的非托管函数:

$Cert = gi Cert:\CurrentUser\My\510F2809B505D9B32F167F6E71001B429CE801B8
$signature = @"
[DllImport("Crypt32.dll", SetLastError = true, CharSet = CharSet.Auto)]
public static extern bool CertGetCertificateContextProperty(
    IntPtr pCertContext,
    uint dwPropId,
    Byte[] pvData,
    ref uint pcbData
);
"@
Add-Type -MemberDefinition $signature -Namespace PKI -Name Crypt32
$pcbData = 0
# if the function returns False, then description is not specified.
$CERT_DESCRIPTION_PROP_ID = 13
if ([PKI.Crypt32]::CertGetCertificateContextProperty($Cert.Handle,$CERT_DESCRIPTION_PROP_ID,$null,[ref]$pcbData)) {
    # allocate a buffer to store property value
    $pvData = New-Object byte[] -ArgumentList $pcbData
    # call the function again to write actual data into allocated buffer
    [void][PKI.Crypt32]::CertGetCertificateContextProperty($Cert.Handle,$CERT_DESCRIPTION_PROP_ID,$pvData,[ref]$pcbData)
    # Description is null-terminated unicode string
    $description = [Text.Encoding]::Unicode.GetString($pvData).TrimEnd()
}
Write-Host $description

将第一行更改为用于检索证书的行。证书对象必须存储在 $cert 变量