Ondrej Sevecek's Blog

$textToSign = 'ahoj'

# Should we envelope the source data into the PKCS#7 package
# or should we create the detached signature, which does not
# contain the source data instead.
$detachedSignature = $false

# Should the resulting PKCS#7 package include the signing certificate?
# None - include no certificate (binary result will be about 500 B)
# EndCertOnly - include only the signing certificate itself
# ExcludeRoot - all certificates in the chain excluding the root
# WholeChain - all certificates in the chain including the root (binary
#              result will be about 3 kB)
$includeOption = 'WholeChain'

# Get first System.Security.Cryptography.X509Certificates.X509Certificate2 certificate
# which contains a private key. We are going for the -CodeSigningCert here
# but any more suitable certificate can be selected according to you needs
$signingCert = dir Cert:\CurrentUser\My -CodeSigningCert | ? { $_.PrivateKey -ne $null } | Select -First 1



Write-Host ('Selected certificate subject: {0}' -f $signingCert.Subject)
Write-Host ('Selected certificate thumbprint: {0}' -f $signingCert.Thumbprint)
Write-Host ('Selected certificate CSP: {0}' -f $signingCert.PrivateKey.CspKeyContainerInfo.ProviderName)


[System.Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null


# We will need the CryptGetObjectUrl function later, so go straight
# and define it here

$cryptGetObjectURLdef = @"

public const int URL_OID_CERTIFICATE_ISSUER = 1;
public const int URL_OID_CERTIFICATE_CRL_DIST_POINT = 2;
public const int URL_OID_CTL_ISSUER = 3;
public const int URL_OID_CTL_NEXT_UPDATE = 4;
public const int URL_OID_CRL_ISSUER = 5;
public const int URL_OID_CERTIFICATE_FRESHEST_CRL = 6;
public const int URL_OID_CRL_FRESHEST_CRL = 7;
public const int URL_OID_CROSS_CERT_DIST_POINT = 8;
public const int URL_OID_CERTIFICATE_OCSP = 9;
public const int URL_OID_CERTIFICATE_OCSP_AND_CRL_DIST_POINT = 10;
public const int URL_OID_CERTIFICATE_CRL_DIST_POINT_AND_OCSP = 11;
public const int URL_OID_CROSS_CERT_SUBJECT_INFO_ACCESS = 12;
public const int URL_OID_CERTIFICATE_ONLY_OCSP = 13;

public const int CRYPT_GET_URL_FROM_PROPERTY = 1;
public const int CRYPT_GET_URL_FROM_EXTENSION = 2;
public const int CRYPT_GET_URL_FROM_UNAUTH_ATTRIBUTE = 3;
public const int CRYPT_GET_URL_FROM_AUTH_ATTRIBUTE = 8;

[DllImport("cryptnet.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern bool CryptGetObjectUrl(
    int pszUrlOid,
    IntPtr pvPara,
    int dwFlags,
    byte[] pUrlArray,
    ref int pcbUrlArray,
    IntPtr pUrlInfo,
    ref int pcbUrlInfo,
    int pvReserved
);
"@

Add-Type -MemberDefinition $cryptGetObjectURLdef -Name CryptNetDll -NameSpace Sevecek

function global:Get-CertificateUrl ([Security.Cryptography.X509Certificates.X509Certificate2] $certificate, [int] $urlType)
# The function wraps CryptGetObjectUrl Win32 API to obtain URL paths from a certificate
# You can obtain CRL (CDP), AIA as well as OCSP paths:
#   CRL: $urlType = URL_OID_CERTIFICATE_CRL_DIST_POINT
#   AIA: $urlType = URL_OID_CERTIFICATE_ISSUER
#   OCSP: $urlType = URL_OID_CERTIFICATE_ONLY_OCSP
{
  [string[]] $urls = @()

  $pvPara = $Cert.Handle

  $pcbUrlArray = 0
  $pcbUrlInfo = 0

  # call the function first with zero-length buffers to get their real sizes
  $apiRes = [Sevecek.CryptNetDll]::CryptGetObjectUrl(
    $urlType,
    $certificate.Handle,
    [Sevecek.CryptNetDll]::CRYPT_GET_URL_FROM_EXTENSION,
    $null,
    [ref] $pcbUrlArray,
    0,
    [ref] $pcbUrlInfo,
    0)

  if ($apiRes -eq $true) {

    $pUrlArray = New-Object byte[] -ArgumentList $pcbUrlArray
    $pUrlInfo = [Runtime.InteropServices.Marshal]::AllocHGlobal($pcbUrlInfo)

    # call the function first with zero-length buffers to get their real sizes
    $apiRes = [Sevecek.CryptNetDll]::CryptGetObjectUrl(
      $urlType,
      $certificate.Handle,
      [Sevecek.CryptNetDll]::CRYPT_GET_URL_FROM_EXTENSION,
      $pUrlArray,
      [ref] $pcbUrlArray,
      $pUrlInfo,
      [ref]$pcbUrlInfo,
      0)

    if ($apiRes -eq $true) {

       # Note that the pUrlArray is actually an CRYPT_URL_ARRAY structure
       # which contain UNICODE encoded URLs. So we need to convert it into string array
       # the very first field is number of URLs. It is either 4 bytes on 32-bit systems
       # while it is 8 bytes on 64-bit systems.
       # The $pUrlArray may look like this on 64-bit system, for example:
       #      02-00-00-00-00-00-00-00
       #      08-E2-57-24-AD-00-00-00
       #      18-E2-57-24-AD-00-00-00
       #      78-E3-57-24-AD-00-00-00
       #      6C-00 l
       #      64-00 d
       #      61-00 a
       #      70-00 p:///...
       #      00-00
       #      68-00 http://...
       #      00-00
       # There are always pointers to the starts of the strings which are \0 terminated

       $is64bit = (Get-WmiObject Win32_OperatingSystem | Select-Object -ExpandProperty OSArchitecture) -eq '64-bit'

       if ($is64bit) {

         $urlCount = [BitConverter]::ToInt64($pUrlArray[0..7], 0)
 
         # and get index of the first character of the first URL
         $firstUrlChar = ($urlCount + 1) * 8 + 8

       } else {

         $urlCount = [BitConverter]::ToInt32($pUrlArray[0..3], 0)
         $firstUrlChar = ($urlCount + 1) * 4 + 4
       }

       for ($i = 0; $i -lt $urlCount; $i ++)
       {
          $lastUrlChar = $firstUrlChar
          while (-not (($pUrlArray[$lastUrlChar] -eq 0) -and ($pUrlArray[$lastUrlChar + 1] -eq 0))) { $lastUrlChar ++ }
          
          $oneUrl = [System.Text.Encoding]::Unicode.GetString($pUrlArray[$firstUrlChar..($lastUrlChar)])
          $urls += $oneUrl

          $firstUrlChar = $lastUrlChar + 3
       }
    }
  }

  return $urls
}


[byte[]] $bytesToSign = [System.Text.ASCIIEncoding]::ASCII.GetBytes($textToSign)

$cntInfo = New-Object System.Security.Cryptography.Pkcs.ContentInfo (, $bytesToSign)


$signedMsg = New-Object System.Security.Cryptography.Pkcs.SignedCms ($cntInfo, $detachedSignature)
$signer = New-Object System.Security.Cryptography.Pkcs.CmsSigner ($signingCert)
$signer.IncludeOption = $includeOption

$signedMsg.ComputeSignature($signer)

$signedResult = $signedMsg.Encode()


Write-Host ('Size of the binary encoded PKCS#7 package: {0}' -f ($signedResult.Count))
Write-Host ('Binary PKCS#7 package: {0}' -f ([BitConverter]::ToString($signedResult)))
Write-Host ('Certificates inside the package: {0}' -f ($signedMsg.Certificates | Out-String))


# Now get all CRL/OCSP paths of all the certificates included
$signedMsg.Certificates | % {

  $oneCert = $_

  Write-Host ('Certificate subject: {0}' -f $oneCert.Subject)
  Write-Host ('Certificate thumbprint: {0}' -f $oneCert.Thumbprint)

  # AIA extension - Authority Information Access contains AIA records
  # and possibly even the OCSP URL
  $oneAIA = $oneCert.Extensions | ? { $_.OID.Value -eq '1.3.6.1.5.5.7.1.1' }
  
  # CDP extension - CRL Distribution Points
  $oneCDP = $oneCert.Extensions | ? { $_.OID.Value -eq '2.5.29.31' }

  # Note that the .Format method returns regionally formated and localized strings
  # so the only thing we rely on here is a wildcard search string. 

  $oneAIAText = ''
  if ($oneAIA -ne $null) { $oneAIAText = $oneAIA.Format($true) }

  #Write-Host 'Formated AIA contents:'
  #Write-Host $oneAIAText

  $oneCDPText = ''
  if ($oneCDP -ne $null) { $oneCDPText = $oneCDP.Format($true) }

  #Write-Host 'Formated CDP contents:'
  #Write-Host $oneCDPText

  # Or we can extract the precise URL values with CryptGetObjectUrl Win32API function
  Write-Host 'Raw AIA contents:'
  Get-CertificateUrl $oneCert ([Sevecek.CryptNetDll]::URL_OID_CERTIFICATE_ISSUER)

  Write-Host 'Raw CDP contents:'
  Get-CertificateUrl $oneCert ([Sevecek.CryptNetDll]::URL_OID_CERTIFICATE_CRL_DIST_POINT)

  Write-Host 'Raw OCSP contents:'
  Get-CertificateUrl $oneCert ([Sevecek.CryptNetDll]::URL_OID_CERTIFICATE_ONLY_OCSP)
}