Skip to content

Dev/fix key usage extension#12

Open
cheinzler-gk wants to merge 4 commits intomainfrom
dev/FixKeyUsageExtension
Open

Dev/fix key usage extension#12
cheinzler-gk wants to merge 4 commits intomainfrom
dev/FixKeyUsageExtension

Conversation

@cheinzler-gk
Copy link
Contributor

Add the option to add key usages in New-SCEPmanCertificate and change the way we add the KeyUsageExtension to the CSR to be considered when they are signed.

@cheinzler-gk cheinzler-gk requested a review from Copilot January 27, 2026 14:53
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds support for configuring key usages in certificate signing requests (CSRs) and certificates by introducing a KeyUsage enum and updating the CSR generation logic to properly handle key usage extensions.

Changes:

  • Introduced a KeyUsage enum to replace string-based key usage validation
  • Refactored CSR key usage handling to use a single X509KeyUsageExtension instead of multiple extensions
  • Added KeyUsage parameter to New-SCEPmanCertificate function with proper parameter forwarding

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File Description
SCEPmanClient/Private/x509/constants.ps1 Defines new KeyUsage enum with valid key usage values
SCEPmanClient/Public/New-CSR.ps1 Refactors key usage handling to use enum type and creates single extension with combined flags
SCEPmanClient/Public/New-SCEPmanCertificate.ps1 Adds KeyUsage parameter and passes it to CSR creation
Tests/New-CSR.Tests.ps1 Updates test to validate key usages are properly set in the CSR extension

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

It "should return a valid CSR with validatable key usages" {
$Request = New-CSR -PrivateKey (New-PrivateKey) -Subject "CN=Test" -ExtendedKeyUsage ClientAuth, ServerAuth -KeyUsage KeyEncipherment, DigitalSignature -Raw

$Request.CertificateExtensions.KeyUsages | Should -BeExactly 'KeyEncipherment, DigitalSignature'
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test validates key usages but doesn't verify that the extension is marked as critical, which is set to $true in line 135 of New-CSR.ps1. Consider adding an assertion to verify the Critical property of the key usage extension.

Copilot uses AI. Check for mistakes.
Comment on lines +133 to +136
$KeyUsageExtension = [System.Security.Cryptography.X509Certificates.X509KeyUsageExtension]::new(
[System.Security.Cryptography.X509Certificates.X509KeyUsageFlags] $KeyUsages,
$true # Critical
)
Copy link

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The $KeyUsages variable contains string values (output from ToString() on line 121), but the cast to X509KeyUsageFlags expects enum values or their string representations that match the enum member names. The conversion may fail or produce unexpected results if the string format doesn't match exactly what the enum expects. Verify that the string-to-enum conversion works correctly, or consider using the original KeyUsage enum values directly instead of converting to strings first.

Copilot uses AI. Check for mistakes.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants