search

PKISolutions / PSPKI

PowerShell PKI Module
Microsoft Public License
375 stars 57 forks source link

Are the compatibility settings for certificate templates in the object returned by Get-CertificateTemplate? #207

Open bencoremans opened 7 months ago

bencoremans commented 7 months ago

Is the Private Key Flag (msPKI-Private-Key-Flag) attribute available in the object returned by the Get-CertificateTemplate cmdlet in the PSPKI module?

Crypt32 commented 7 months ago

Yes, it is under $template.Settings.Cryptography.PrivateKeyOptions

bencoremans commented 7 months ago

What I'm aiming to understand is the process of reconstructing a certificate template's original configuration using the object returned by the Get-CertificateTemplate cmdlet. Specifically, I'm interested in identifying the necessary attributes that would allow me to determine the original settings through a Bitwise OR operation. Could you provide some insights or guidance on which attributes are crucial for this task and how they might be used to achieve the desired outcome?

Crypt32 commented 7 months ago

You may need to reverse the DS attribute decomposition back from properties to DS attributes.

bencoremans commented 7 months ago

Thank you for your guidance on reversing the DS attribute decomposition from properties back to DS attributes. To follow up on that, I'm trying to understand how to extract and reconstruct the original values of specific flags, such as the msPKI-Private-Key-Flag, from the output of the Get-CertificateTemplate cmdlet.

For example, the msPKI-Private-Key-Flag for a template is set to 101056768, which encompasses various flags like TEMPLATE_CLIENT_VER_THRESHOLD, TEMPLATE_SERVER_VER_THRESHOLD, CTPRIVATEKEY_FLAG_USE_LEGACY_PROVIDER, and CTPRIVATEKEY_FLAG_ATTEST_NONE.

Could you advise on how to interpret the cmdlet's output, to derive these flag values? Are there specific attributes in the cmdlet's output that correspond to these flags, and if so, how can they be used to reconstruct the original msPKI-Private-Key-Flag value?