Trusted Publisher Checks for Azure Trusted Signing by jborean93 · Pull Request #25824 · PowerShell/PowerShell

Jordan Borean (jborean93) · 2025-08-06T05:50:26Z

PR Summary

Add support for checking the Azure Trusted Signing publisher identifier alongside the thumbprint. This check will verify whether the unique Azure TS OID present in the EKU is in any certificate in the TrustedPublishers store. It will also check whether the OID is present in the untrusted store making it possible to distrust all certificates for that Azure identity.

PR Context

Fixes: #21550

I need to spend some time to figure out how I could potentially add tests for this. It should be theoretically possible to generate certs with the same ID or at least have some test hook that changes what ID to check for but I'll think about it.

The behaviour of the untrusted check might need to be adjusted to only check the thumbprint only. Currently if any cert with the Azure identity OID is present in the untrusted store then all certs with that same OID will be untrusted. If the PowerShell team only wants to reject specific certs then that logic will have to be adjusted.

Edit: Tests added and untrusted check moved back to only untrusting by thumbprint. It is not easy to get the root CA thumbprint for an untrusted cert because Windows treats it as rejected and won't work with the X509Chain class. Upon reflection I think this behaviour is nicer as it allows you to reject specific timeframes/certs rather than the whole identity at once. Maybe an extra location could be used to reject identities entirely if desired.

PR Checklist

Add support for checking the Azure Trusted Signing publisher identifier alongside the thumbprint. This check will verify whether the unique Azure TS OID present in the EKU is in any certificate in the TrustedPublishers store. It will also check whether the OID is present in the untrusted store making it possible to distrust all certificates for that Azure identity.

Ian McMillan (ianjmcm) · 2025-08-11T14:40:03Z

This looks really good.

Copilot

Pull Request Overview

This PR adds support for trusted publisher checks when using Azure Trusted Signing certificates in PowerShell's execution policy validation. The implementation allows PowerShell to trust Azure Trusted Signing certificates based on their unique publisher identifier (extracted from EKU OIDs) rather than only by certificate thumbprint.

Introduces Azure Trusted Signing publisher identifier checking alongside existing thumbprint validation
Adds comprehensive test coverage for the new trusted publisher functionality
Enhances security by validating certificates against both trusted and disallowed certificate stores

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
`SecurityManager.cs`	Implements Azure Trusted Signing publisher ID extraction and validation logic in certificate trust checking
`ExecutionPolicy.Tests.ps1`	Adds comprehensive test suite covering various Azure Trusted Signing certificate trust scenarios

Copilot · 2025-08-11T18:35:02Z

+                    azurePublisherId == trustedIdentifier)
+                {
+                    isTrusted = true;
+                    break;


The break statement exits the loop early when an Azure publisher ID match is found, but the thumbprint check continues through all certificates. For consistency and performance, consider adding a break after setting isTrusted = true for the thumbprint match as well.

Steve Lee (SteveL-MSFT)

Since this is coming in late for 7.6, can you make this an Experimental Feature?

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Jordan Borean (jborean93) · 2025-08-11T20:15:51Z

Steve Lee (@SteveL-MSFT) can do. Do you see any problems with this method or do you prefer the registry route mentioned in the issue? Any concerns about the EKU + thumbprint method for the unique identifier and whether the root or immediate issuer should be used?

Steve Lee (SteveL-MSFT) · 2025-11-24T19:43:03Z

Steve Lee (@SteveL-MSFT) can do. Do you see any problems with this method or do you prefer the registry route mentioned in the issue? Any concerns about the EKU + thumbprint method for the unique identifier and whether the root or immediate issuer should be used?

Was discussed in Security-WG, seems fine to us. Thanks!

Ilya (iSazonov) · 2025-11-25T04:16:07Z


+            // Do a final check to verify that the certificate has not been
+            // explicitly added to the "Disallowed" store.
+            if (isTrusted && !IsUntrustedPublisher(signerCertificate))


I'd expect IsUntrustedPublisher() on top of the method - it makes no sense to check trust if certificate is blocked.
Also it would be nice to add the check in trace too.

Travis Plunk (TravisEz13)

I’m good with this. Assuming the Azure Trusted Signing cert shape follows the documented format, the trust logic appears fail-secure and the added tests give good coverage of the intended behavior. Approved.

Jaxel Rojas Lopez (Jaxelr) · 2026-07-16T12:45:37Z

        #region constructor

+        /// <summary>
+        /// The EKU OID that identifies a certificate is from Azure Trusted Signing.


One small nit, Trusted Signing has been rebranded to Artifact Signing, any chance we could include this rename on this PR?

I am also good with submitting a subsequent PR focusing on the rebranding.

Ryan Yates (kilasuit)

Based on the Service Name change we should make these changes in the code so that we aren't linking to old, out of date service names.

I'd also recommend making similar changes in the title & body section so that in the release notes it aligns to the new name as well.

Ryan Yates (kilasuit) · 2026-07-16T23:41:18Z

        #region constructor

+        /// <summary>
+        /// The EKU OID that identifies a certificate is from Azure Trusted Signing.


Suggested change

/// The EKU OID that identifies a certificate is from Azure Trusted Signing.

/// The EKU OID that identifies a certificate is from Azure Artifact Signing.

Ryan Yates (kilasuit) · 2026-07-16T23:41:39Z

+        /// <summary>
+        /// The EKU OID that identifies a certificate is from Azure Trusted Signing.
+        /// </summary>
+        private const string _azureTrustedSigningIdentifier = "1.3.6.1.4.1.311.97.1.0";


Suggested change

private const string _azureTrustedSigningIdentifier = "1.3.6.1.4.1.311.97.1.0";

private const string _azureArtifactSigningIdentifier = "1.3.6.1.4.1.311.97.1.0";

Ryan Yates (kilasuit) · 2026-07-16T23:41:54Z

+        private const string _azureTrustedSigningIdentifier = "1.3.6.1.4.1.311.97.1.0";
+
+        /// <summary>
+        /// The OID prefix that uniquely identifies a certificate issued by Azure Trusted Signing.


Suggested change

/// The OID prefix that uniquely identifies a certificate issued by Azure Trusted Signing.

/// The OID prefix that uniquely identifies a certificate issued by Azure Artifact Signing.

Ryan Yates (kilasuit) · 2026-07-16T23:42:09Z

+        /// <summary>
+        /// The OID prefix that uniquely identifies a certificate issued by Azure Trusted Signing.
+        /// </summary>
+        private const string _azureTrustedSigningIdPrefix = "1.3.6.1.4.1.311.97.";


Suggested change

private const string _azureTrustedSigningIdPrefix = "1.3.6.1.4.1.311.97.";

private const string _azureArtifactSigningIdPrefix = "1.3.6.1.4.1.311.97.";

Ryan Yates (kilasuit) · 2026-07-16T23:42:32Z

+        /// <summary>
+        /// Checks if the publisher is trusted by checking whether the
+        /// certificate thumbprint is in the "Trusted Publishers" store or
+        /// the Azure Trusted Signer Publisher ID is present in the


Suggested change

/// the Azure Trusted Signer Publisher ID is present in the

/// the Azure Artifact Signer Publisher ID is present in the

Ryan Yates (kilasuit) · 2026-07-16T23:43:55Z

+        /// <param name="certificate">The certificate to check.</param>
+        /// <param name="publisherId">An opaque blob that uniquely identifies the publisher if present.</param>
+        /// <returns>True when the certificate has the Azure Trusted Signer Publisher ID EKU.</returns>
+        private static bool TryGetAzureTrustedSignerPublisherId(


Suggested change

private static bool TryGetAzureTrustedSignerPublisherId(

private static bool TryGetAzureArtifactSignerPublisherId(

Ryan Yates (kilasuit) · 2026-07-16T23:44:18Z

+            X509Certificate2 certificate,
+            [NotNullWhen(true)] out string? publisherId)
+        {
+            bool containsAzTSIdentifier = false;


Suggested change

bool containsAzTSIdentifier = false;

bool containsAzASIdentifier = false;

Ryan Yates (kilasuit) · 2026-07-16T23:44:51Z

+                        if (oid.Value == _azureTrustedSigningIdentifier)
+                        {
+                            containsAzTSIdentifier = true;
+                        }
+                        else if (oid.Value?.StartsWith(_azureTrustedSigningIdPrefix) == true)
+                        {
+                            azurePubOid = oid.Value;


Suggested change

if (oid.Value == _azureTrustedSigningIdentifier)

{

containsAzTSIdentifier = true;

}

else if (oid.Value?.StartsWith(_azureTrustedSigningIdPrefix) == true)

{

azurePubOid = oid.Value;

if (oid.Value == _azureArtifactSigningIdentifier)

{

containsAzASIdentifier = true;

}

else if (oid.Value?.StartsWith(_azureArtifactSigningIdPrefix) == true)

{

azurePubOid = oid.Value;

Ryan Yates (kilasuit) · 2026-07-16T23:45:04Z

+            }
+
+            string? caThumbprint = null;
+            if (containsAzTSIdentifier && azurePubOid is not null)


Suggested change

if (containsAzTSIdentifier && azurePubOid is not null)

if (containsAzASIdentifier && azurePubOid is not null)

Ryan Yates (kilasuit) · 2026-07-16T23:45:15Z

+            string? caThumbprint = null;
+            if (containsAzTSIdentifier && azurePubOid is not null)
+            {
+                s_tracer.WriteLine("Certificate {0} has Azure Trusted Signer EKU OID {1}.",


Suggested change

s_tracer.WriteLine("Certificate {0} has Azure Trusted Signer EKU OID {1}.",

s_tracer.WriteLine("Certificate {0} has Azure Artifact Signer EKU OID {1}.",

Jordan Borean (jborean93) · 2026-07-17T03:23:45Z

Appreciate the reviews but I don't really have time to work on this again and go through it all. You are more than welcome to follow this up in a separate PR or use the changes here as a baseline for another PR before merging.

microsoft-github-policy-service · 2026-09-25T17:00:57Z

This pull request has been automatically marked as Review Needed because it has been there has not been any activity for 7 days.
Maintainer, please provide feedback and/or mark it as Waiting on Author

Jordan Borean (jborean93) mentioned this pull request Aug 6, 2025

Add support for Enterprise signed scripts #21550

Open

Chrissy LeMaire (potatoqualitee) mentioned this pull request Aug 5, 2025

EXPECTED ERROR: Update-Module dbatools Authenticode Issue for 2.5.5 / 2.7.x dataplat/dbatools#9748

Closed

Jordan Borean (jborean93) added 2 commits August 7, 2025 13:38

Add tests and change untrusted logic

ba75161

Test tweak

2bfed51

Steve Lee (SteveL-MSFT) requested a review from Copilot August 11, 2025 18:34

Copilot AI reviewed Aug 11, 2025

View reviewed changes

Steve Lee (SteveL-MSFT) requested changes Aug 11, 2025

View reviewed changes

microsoft-github-policy-service Bot added the Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept label Aug 11, 2025

Update src/System.Management.Automation/security/SecurityManager.cs

941e45d

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

microsoft-github-policy-service Bot removed the Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept label Aug 11, 2025

microsoft-github-policy-service Bot added the Review - Needed The PR is being reviewed label Aug 19, 2025

Travis Plunk (TravisEz13) added CL-Experimental Indicates that a PR should be marked as an Experimental Feature in the Change Log WG-Security security related areas such as JEA Needs-Triage The issue is new and needs to be triaged by a work group. labels Sep 23, 2025

Steve Lee (SteveL-MSFT) approved these changes Nov 24, 2025

View reviewed changes

Travis Plunk (TravisEz13) requested a review from Steve Lee (SteveL-MSFT) November 24, 2025 19:42

microsoft-github-policy-service Bot removed the Review - Needed The PR is being reviewed label Nov 24, 2025

Ilya (iSazonov) reviewed Nov 25, 2025

View reviewed changes

microsoft-github-policy-service Bot added the Review - Needed The PR is being reviewed label Dec 2, 2025

Steve Lee (SteveL-MSFT) removed the Needs-Triage The issue is new and needs to be triaged by a work group. label May 19, 2026

microsoft-github-policy-service Bot removed the Review - Needed The PR is being reviewed label May 19, 2026

Steve Lee (SteveL-MSFT) added this to the 7.7-Consider milestone May 19, 2026

Steve Lee (SteveL-MSFT) requested a review from Patrick Meinecke (SeeminglyScience) May 19, 2026 20:59

Mike Thompson (mthompson83) mentioned this pull request Jun 2, 2026

PSAuthorizationManager should check LocalMachine\TrustedPublisher for AllSigned execution #27556

Open

5 tasks done

Steve Lee (SteveL-MSFT) added the WG-Reviewed A Working Group has reviewed this and made a recommendation label Jul 6, 2026

Travis Plunk (TravisEz13) approved these changes Jul 15, 2026

View reviewed changes

Merge branch 'master' into trusted-publisher-az-ts

3090226

Travis Plunk (TravisEz13) requested a review from a team as a code owner July 15, 2026 20:27

Jaxel Rojas Lopez (Jaxelr) reviewed Jul 16, 2026

View reviewed changes

Ryan Yates (kilasuit) suggested changes Jul 16, 2026

View reviewed changes

microsoft-github-policy-service Bot added the Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept label Jul 16, 2026

microsoft-github-policy-service Bot removed the Waiting on Author The PR was reviewed and requires changes or comments from the author before being accept label Jul 17, 2026

microsoft-github-policy-service Bot added the Review - Needed The PR is being reviewed label Sep 25, 2026

	/// The EKU OID that identifies a certificate is from Azure Trusted Signing.
	/// The EKU OID that identifies a certificate is from Azure Artifact Signing.

	private const string _azureTrustedSigningIdentifier = "1.3.6.1.4.1.311.97.1.0";
	private const string _azureArtifactSigningIdentifier = "1.3.6.1.4.1.311.97.1.0";

	/// The OID prefix that uniquely identifies a certificate issued by Azure Trusted Signing.
	/// The OID prefix that uniquely identifies a certificate issued by Azure Artifact Signing.

	/// the Azure Trusted Signer Publisher ID is present in the
	/// the Azure Artifact Signer Publisher ID is present in the

	private static bool TryGetAzureTrustedSignerPublisherId(
	private static bool TryGetAzureArtifactSignerPublisherId(

	bool containsAzTSIdentifier = false;
	bool containsAzASIdentifier = false;

	if (containsAzTSIdentifier && azurePubOid is not null)
	if (containsAzASIdentifier && azurePubOid is not null)

	s_tracer.WriteLine("Certificate {0} has Azure Trusted Signer EKU OID {1}.",
	s_tracer.WriteLine("Certificate {0} has Azure Artifact Signer EKU OID {1}.",

Conversation

Jordan Borean (jborean93) commented Aug 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

PR Context

PR Checklist

Uh oh!

Ian McMillan (ianjmcm) commented Aug 11, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Copilot AI Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Steve Lee (SteveL-MSFT) left a comment

Choose a reason for hiding this comment

Uh oh!

Jordan Borean (jborean93) commented Aug 11, 2025

Uh oh!

Steve Lee (SteveL-MSFT) commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Travis Plunk (TravisEz13) left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Ryan Yates (kilasuit) left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Jordan Borean (jborean93) commented Jul 17, 2026

Uh oh!

microsoft-github-policy-service Bot commented Sep 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Jordan Borean (jborean93) commented Aug 6, 2025 •

edited

Loading

Steve Lee (SteveL-MSFT) commented Nov 24, 2025 •

edited

Loading

Ryan Yates (kilasuit) left a comment •

edited

Loading