Knowledge Base (Posts about certificates)

CoMaps will eventually trust user provided root certificates!

bgstack15 — Thu, 09 Jul 2026 12:49:00 GMT

Squee! Some of my favorite words colliding: free software, android apps, and certificates! If only it had FreeIPA (ldap/kerberos) and Devuan and Age of Empires 2 somehow, it'd be the best post on the World Wide Web!

Just like with a fix for f-droid a few years ago, CoMaps will eventually be able to trust user-provided root certificates in Android! While I wrote the PRs for the linked issues, I was just standing on the shoulders of giants. And the docs are public.

This would only be useful if you are using a custom map server. At present OrganicMaps does not have a custom map server option and wouldn't need this feature and indeed does not have it.

Screenshot showing my merged pull request

Drag-and-drop to sign code

bgstack15 — Sat, 02 May 2026 13:02:00 GMT

I set up a simpler hands-on process for signing binary assets of various kinds. There are apparently still people in the world who don't want to "sign every rubbish binary blob the software developers produce." (Read: give developers a CI/CD with automatic signing, so that they can produce whatever malware they want and get a company signature on it.) For small-scale operations, this suffices to manually sign assets.

The Windows world calls this "Authenticode." There is no direct equivalent in the Free Software world, because official software comes from gpg-signed rpm or apt repositories. Additional installation assets are usually published with checksums on https pages.

The solution involves the signing process with a specific certificate identified by thumbprint. Windows really wants to identify certificates by thumbprint rather than by serial number. Sometimes that means you can get a new certificate with the exact same thumbprint, which I'm sure is useful somewhere. (It also means you're using the same private key, which may or may not be within your certificate policy to allow.)

Yes, this is partially vibecoded. It's my standard format of a library that can be loaded into the current shell (I forgot how and why to use modules.)

files/2026/listings/Sign-Code.ps1 (Source)

	`#!/bin/pwsh`
	`# File: Sign-Code.ps1`
	`# Last-Modified: 2026-04-01T11:07:34-0400`
	`# Locations:`
	`# \\utility5\e$\CodeSign\Scripts`
	`# Author: bgstack15`
	`# Startdate: 2026-03-31`
	`# Title: Sign-Code`
	`# Project: Codesign`
	`# Purpose: Functions for easily signing binaries on utility5`
	`# History:`
	`# Usage:`
	`# As a library, . .\Sign-Code.ps1`
	`# Or directly, ".\Sign-Code.ps1"`
	`# References:`
	`# https://www.scriptinglibrary.com/languages/powershell/how-to-modify-your-proxy-settings-with-powershell/`
	`# https://4sysops.com/archives/how-to-create-an-open-file-folder-dialog-box-with-powershell/`
	`# Improve:`
	`# Dependencies:`
	`# Cert loaded in Cert:\LocalMachine\My`
	`# Documentation:`
	`<#`
	`.SYNOPSIS`
	`Functions for easily signing binaries on the utility server.`

	`.DESCRIPTION`
	`This script provides functions to configure proxy settings, select files via a dialog,`
	`sign binaries using signtool.exe, and move signed files to a destination folder.`
	`It supports being dot-sourced as a library or run directly to invoke the signing process.`

	`.NOTES`
	`.USAGE`
	`As a library (import functions for manual use):`
	`. .\Sign-Code.ps1`

	`Run directly (sign files from default or specified folders):`
	`.\Sign-Code.ps1`

	`.PARAMETER Set-Proxy`
	`Configures the user's system proxy settings by modifying registry keys.`

	`.PARAMETER Get-File-Dialog`
	`Opens a Windows File Open dialog to select one or more files.`

	`.PARAMETER Sign-File`
	`Signs each file using signtool.exe and moves successfully signed files to a destination folder.`

	`.PARAMETER Ask-Sign-Files`
	`Main function to select files, and sign them.`

	`.DEPENDENCIES`
	`- Windows signtool.exe located at the specified path.`
	`- Code signing certificate loaded in Cert:\LocalMachine\My.`
	`- User has write permissions to destination folders.`

	`.REFERENCES`
	`- https://www.scriptinglibrary.com/languages/powershell/how-to-modify-your-proxy-settings-with-powershell/`
	`- https://4sysops.com/archives/how-to-create-an-open-file-folder-dialog-box-with-powershell/`
	`#>`

	`#region Proxy Configuration Function`

	`Function Set-Proxy {`
	`<#`
	`.SYNOPSIS`
	`Sets the system proxy server and port for the current user.`

	`.PARAMETER Server`
	`The proxy server address (e.g., proxy.example.com).`

	`.PARAMETER Port`
	`The proxy server port number (e.g., 8080).`

	`.EXAMPLE`
	`Set-Proxy -Server proxy.example.com -Port 8080`
	`#>`
	`[CmdletBinding()]`
	`[Alias('proxy')]`
	`[OutputType([string])]`
	`Param`
	`(`
	`[Parameter(Mandatory = $true,`
	`ValueFromPipelineByPropertyName = $true,`
	`Position = 0)]`
	`[string]$Server,`

	`[Parameter(Mandatory = $true,`
	`ValueFromPipelineByPropertyName = $true,`
	`Position = 1)]`
	`[int]$Port`
	`)`

	`# Set proxy server address and enable proxy in the user's registry`
	`Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name ProxyServer -Value "$($Server):$($Port)"`
	`Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -Name ProxyEnable -Value 1`

	`# (Optional) Display the current proxy settings`
	`# Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' \| Select-Object ProxyServer, ProxyEnable`
	`}`

	`#endregion Proxy Configuration Function`

	`#region File Selection Function`
	`Function Get-File-Dialog {`
	`<#`
	`.SYNOPSIS`
	`Opens a file open dialog for the user to select one or multiple files.`

	`.PARAMETER InitialFolder`
	`The folder that the dialog will open initially.`

	`.OUTPUTS`
	`String[] - Full paths of the selected files.`

	`.EXAMPLE`
	`$files = Get-File-Dialog -InitialFolder "E:\CodeSign\ToBeSigned"`
	`#>`
	`[CmdletBinding()]`
	`Param(`
	`[Parameter(Mandatory = $false)]`
	`[string]$InitialFolder = "E:\CodeSign\ToBeSigned"`
	`)`

	`# Load Windows Forms assembly for GUI dialog`
	`Add-Type -AssemblyName System.Windows.Forms`

	`# Configure and show OpenFileDialog allowing multi-selection`
	`$FileBrowser = New-Object System.Windows.Forms.OpenFileDialog -Property @{`
	`InitialDirectory = $InitialFolder;`
	`Title = "Choose file(s) to sign";`
	`MultiSelect = $true`
	`}`
	`$null = $FileBrowser.ShowDialog()`

	`# Return array of selected file paths`
	`return $FileBrowser.FileNames`
	`}`

	`#endregion File Selection Function`

	`#region File Signing Function`

	`Function Sign-File {`
	`<#`
	`.SYNOPSIS`
	`Signs one or more files using signtool.exe and moves successfully signed files.`

	`.PARAMETER FilePath`
	`One or more full file paths to sign. Supports pipeline input.`

	`.PARAMETER DestinationFolder`
	`Directory where successfully signed files will be moved.`

	`.NOTES`
	`Requires signtool.exe at specified path and appropriate certificates installed.`

	`.EXAMPLE`
	`$files \| Sign-File -DestinationFolder "E:\CodeSign\SignedCode"`
	`#>`
	`[CmdletBinding()]`
	`Param(`
	`[Parameter(Mandatory = $true,`
	`ValueFromPipeline = $true,`
	`ValueFromPipelineByPropertyName = $true,`
	`Position = 0)]`
	`[string[]]$FilePath,`

	`[Parameter(Mandatory = $true)]`
	`[string]$DestinationFolder`
	`)`

	`Process {`
	`foreach ($file in $FilePath) {`
	`Write-Host "Signing file: $file"`

	`# Execute signtool.exe with specified options`
	& "C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\signtool.exe" sign `
	/fd sha256 /td sha256 /v `
	/f "E:\CodeSign\cert2025\example.cer" `
	/sha1 B38EXAMPLE17340436A80B0A2FDC3BEC9352250F `
	/kc CodeSignExample2025 `
	/csp "Safenet Key Storage Provider" `
	/tr http://timestamp.digicert.com `
	`$file`

	`$exitCode = $LASTEXITCODE`

	`if ($exitCode -eq 0) {`
	`# Signing succeeded; ensure destination folder exists`
	`if (-not (Test-Path -Path $DestinationFolder)) {`
	`New-Item -Path $DestinationFolder -ItemType Directory -Force \| Out-Null`
	`}`

	`# Move signed file to destination folder`
	`$destinationPath = Join-Path -Path $DestinationFolder -ChildPath (Split-Path $file -Leaf)`
	`try {`
	`Move-Item -Path $file -Destination $destinationPath -Force`
	`Write-Host "Moved file to $destinationPath"`
	`}`
	`catch {`
	`Write-Warning "Failed to move file $file to ${destinationPath}: $_"`
	`}`
	`}`
	`else {`
	`Write-Warning "Signing failed for $file with exit code $exitCode. File not moved."`
	`}`
	`}`
	`}`
	`}`

	`#endregion File Signing Function`

	`#region Main Orchestration Function`

	`Function Ask-Sign-Files {`
	`<#`
	`.SYNOPSIS`
	`Orchestrates proxy setup, file selection, and signing of files.`

	`.PARAMETER DestinationFolder`
	`Optional. Destination folder for signed files. Defaults to "E:\CodeSign\SignedCode".`

	`.PARAMETER InitialFolder`
	`Optional. Initial folder for the file selection dialog.`

	`.EXAMPLE`
	`Ask-Sign-Files -InitialFolder "E:\CodeSign\ToBeSigned" -DestinationFolder "E:\CodeSign\SignedCode"`
	`#>`
	`[CmdletBinding()]`
	`Param(`
	`[Parameter(Mandatory = $false)]`
	`[string]$DestinationFolder = "E:\CodeSign\SignedCode",`

	`[Parameter(Mandatory = $false)]`
	`[string]$InitialFolder`
	`)`

	`# Configure proxy settings for the user environment`
	`Set-Proxy -Server proxy.example.com -Port 8080`

	`# Get files to sign via file dialog`
	`$Infiles = Get-File-Dialog -InitialFolder $InitialFolder`

	`# Pass files and destination folder to signing function`
	`$Infiles \| Sign-File -DestinationFolder $DestinationFolder`
	`}`

	`#endregion Main Orchestration Function`

	`#region Script Execution Control`

	`# Check if script is being run directly or dot-sourced/imported`
	`# If called directly, with more than 0 arguments`

	`if ($args.Count -gt 0) {`
	`# Files were dropped onto the script or shortcut, process them directly`
	`# Assuming the DestinationFolder is set or can be defaulted`
	`$destinationFolder = "E:\CodeSign\SignedCode"`

	`# Validate that all args are files`
	`$filesToSign = $args \| Where-Object { Test-Path $_ -PathType Leaf }`
	`if ($filesToSign.Count -eq 0) {`
	`Write-Warning "No valid files passed as arguments."`
	`exit 1`
	`}`

	`# Call Sign-File with the files from args`
	`$filesToSign \| Sign-File -DestinationFolder $destinationFolder`
	`}`
	`elseif ($MyInvocation.InvocationName.Contains($MyInvocation.MyCommand.Name) -or`
	`$MyInvocation.InvocationName -eq $PSCommandPath) {`
	`# Script is being run directly; invoke main function with default folders`
	`Ask-Sign-Files -InitialFolder "E:\CodeSign\ToBeSigned" -DestinationFolder "E:\CodeSign\SignedCode"`
	`}`

	`#endregion Script Execution Control`

And somehow in the loss of progress, you cannot set up a shortcut to run powershell, and have it accept parameters. (Or I never learned. I'm sure the comments will correct me shortly.) So you can do that with the following batch script.

files/2026/listings/Sign-Code.bat (Source)

	`@echo off`
	`REM File: Sign-Code.bat`
	`REM Purpose: make it possible to drop files onto this`
	`:: Check for admin rights by trying to create a folder in %windir%`
	`>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"`

	`if '%errorlevel%' NEQ '0' (`
	`echo Requesting administrative privileges...`
	`powershell.exe -Command "Start-Process -FilePath '%~f0' -ArgumentList '%*' -Verb RunAs"`
	`exit /b`
	`)`

	`:: If we get here, we have admin rights`
	`powershell.exe -NoProfile -ExecutionPolicy Bypass -File "E:\CodeSign\Scripts\Sign-Code.ps1" %*`
	`pause`

Set up a shortcut to the script. You don't need to customize parameters; it will already handle them correctly. Set up your .lnk to point to C:\Path\Sign-Code.bat and that is all.

Adding Let's Encrypt root certs to Android 6

bgstack15 — Wed, 12 Feb 2025 13:53:00 GMT

Old Android devices do not have the current Let's Encrypt root certificates installed, e.g., Android < 7.0.

You might need to enable a screen lock password or pin (Settings -> Security -> Screen lock -> PIN). You can remove it after installing these certs.

Install these certificates for "VPN and apps." Note that old Android might want to download these as a .crt file extension, in order to prompt you to install them as a trusted root, which is left as an exercise for the reader.

ISRG Root X1 https://letsencrypt.org/certs/isrgrootx1.pem
Let's Encrypt R3 https://letsencrypt.org/certs/lets-encrypt-r3.pem

References

Weblinks

CEP/CES enrollment with UsernamePassword auth from Linux to ADCS

bgstack15 — Mon, 07 Oct 2024 12:46:00 GMT

If you have GNU/Linux clients that need to use CEP/CES with UsernamePassword auth (because kerberos is unavailable for bad reasons), you can use my new project cepceslib.

It's not better than using proper kerberos auth, but it serves a niche my users came across.

Read the readme, but the basic usage is:

CESURL="https://ces.example.com/Example%20CA%20Name_CES_UsernamePassword/service.svc/CES" KEYFILE=example.key CSRFILE=example.csr CESPASSWORDFILE=~/.config/user1 CESUSER=sa839 CERTFILE=example.pem TEMPLATE="WebServer" CN="example1.example.com" SANS="san1.example.com,san2.example.com" ./cepceslib.sh use_ces

Which will generate the private key and public certificate to the files indicated.

This newer tech was much easier to use, even with the hidden invisible magic values of xml needed, than my crusty certreq. I'm very proud of certreq, and it served my needs then, but with the modern way of disposing of old (and presumably insecure) tech, I got to write a new client, and it was way smaller and easier!

asn1parse and underscores

bgstack15 — Mon, 02 Sep 2024 13:08:00 GMT

If you are building a CSR that includes the oid for a Microsoft Certificate Services template name, and that name includes an underscore, you might get an error when building a csr.

Error checking request extension section req_ext
00CCADFE01000000:error:0680007C:asn1 encoding routines:ASN1_mbstring_ncopy:illegal characters:crypto/asn1/a_mbstr.c:113:
00CCADFE01000000:error:0688000D:asn1 encoding routines:asn1_str2type:ASN1 lib:crypto/asn1/asn1_gen.c:681:string=ABC_NAME_TESTING
00CCADFE01000000:error:11000074:X509 V3 routines:v3_generic_extension:extension value error:crypto/x509/v3_conf.c:260:value=PRINTABLESTRING:ABC_NAME_TESTING

So what you can do is switch your openssl.cnf to use a different data type: UTF8STRING.

oid_section = new_oids
[ new_oids ]
certificateTemplateName = 1.3.6.1.4.1.311.20.2
[ req_ext ]
certificateTemplateName = ASN1:UTF8STRING:ABC_NAME_TESTING

Read signature of .ps1 file with CLI on Linux

bgstack15 — Tue, 13 Aug 2024 13:19:00 GMT

If you wish to read the PKCS7-encoded signature on a powershell script, and you don't have osslsigncode verify available to you (from https://github.com/mtrojnar/osslsigncode), you can use this script.

files/2024/listings/read-signature.sh (Source)

	`#!/usr/bin/env sh`
	`# File: read-signature.sh`
	`# Location: blog`
	`# Author: bgstack15`
	`# SPDX-License-Identifier: GPL-3.0-only`
	`# Startdate: 2024-08-08-5 14:35`
	`# Title: Read Signature`
	`# Purpose: Read codesign signature on a powershell script on Unix-like cli`
	`# History:`
	`# Usage:`
	`# Reference:`
	`# Improve:`
	`# Dependencies:`
	`# openssl, gsed, gawk, posix shell`
	`# Documentation:`
	`# Skipping SAN; tends to not be used on codesigning certs?`

	`command -v sed 1>/dev/null 2>&1 && SED=sed`
	`command -v gsed 1>/dev/null 2>&1 && SED=gsed`
	`command -v awk 1>/dev/null 2>&1 && AWK=awk`
	`command -v gawk 1>/dev/null 2>&1 && AWK=gawk`

	`read_sig() {`
	`_in="${INFILE:-${1}}"`
	`_in="${_in:-/dev/stdin}"`
	`test "${_in}" = "-" && _in="/dev/stdin"`
	`_contents="$(`
	`printf '%s\n' '-----BEGIN PKCS7-----'`
	`<"${_in}" "${SED}" -r -n '/^# SIG # Begin/,/^# SIG # End/{s/^\# //;p;}' \| tr -d '\r' \| grep -v -e 'signature block'`
	`printf '%s\n' '-----END PKCS7-----'`
	`)"`
	`# would need to parse SANs here if any.`
	`echo "${_contents}" \| openssl pkcs7 -in /dev/stdin -print_certs \| openssl x509 -in /dev/stdin -noout -subject -issuer -serial -email -dates`
	`# Print date`
	`echo "${_contents}" \| openssl pkcs7 -in /dev/stdin -print -noout \| "${AWK}" '/signingTime/{getline;getline;gsub(":","",$NF);print $NF}' \| "${SED}" -r -e 's/^(.{2})(.{2})(.{2})(.{2})(.{2})(.{2})/timestamp=20\1-\2-\3T\4:\5:\6/;'`
	`}`

Notice how I make sure we find GNU sed and awk, because the old BSD ones use a different syntax that are not worth learning. Just use real sed and awk.

openssl read cert template

bgstack15 — Sun, 02 Jun 2024 13:06:06 GMT

Here's a post that combines all my favorite technologies! This is so fun.

If you want to use openssl to read the template name of a Microsoft Certificate Services certificate, you have to look up the OID that is stored on the cert and find it in the directory.

files/2024/listings/read-cert-template.sh (Source)

#!/usr/bin/env sh
# File: read-cert-template.sh
# Location: blog exclusive
# Author: bgstack15
# SPDX-License-Identifier: GPL-3.0-only
# Startdate: 2024-05-16-5 10:23
# Title: Read cert template
# Purpose: read certificate and print cert tempalte name if discoverable
# History:
# Usage:
# Reference: see blog post
# Improve:
# Dependencies:
#    openssl, ldapsearch, ldap credential in read-cert-template.conf

# Load conf, RCT_LDAPSERVER RCT_LDAPBASE RCT_LDAPAUTH1 RCT_LDAPAUTH2
RCT_CONF="${RCT_CONF:-${HOME}/.config/read-cert-template.conf}"
test -f "${RCT_CONF}" && . "${RCT_CONF}"

# use RCT_IN env var or first parameter, or else standard input
RCT_IN="${RCT_IN:-${1}}"
RCT_IN="${RCT_IN:-/dev/stdin}"

if echo "${RCT_IN}" | grep -qE -e '^-$|^stdin$' ;
then
   _input="$( cat )"
else
   _input="$( cat "${RCT_IN}" )"
fi

oid="$( echo "${_input}" | openssl x509 -in /dev/stdin -noout -text -certopt no_header,no_version,no_serial,no_signame,no_validity,no_subject,no_issuer,no_pubkey,ext_parse | sed -n -r -e '/1.3.6.1.4.1.311.21.7/,+2p' | awk '/OBJECT/{print $NF}' | sed -r -e 's/^://;' )"
test -n "${VERBOSE}" && printf 'oid=%s\n' "${oid}" 1>&2
LDAPTLS_REQCERT=never ldapsearch -LLL -o ldif-wrap=9000 -H "${RCT_LDAPSERVER}" ${RCT_LDAPAUTHUNQUOTED} "${RCT_LDAPAUTHQUOTED}" -b "CN=Certificate Templates,CN=Public Key,CN=Services,CN=Configuration,${RCT_LDAPBASE}" "(msPKI-Cert-Template-OID=${oid})" CN | awk '$1~/cn:/{$1="";print;}' | sed -r -e 's/^ +| +$//g;'

files/2024/listings/read-cert-template.conf (Source)

# File: ~/.config/read-cert-template.conf
RCT_LDAPSERVER=ldaps://example.corp
# The "CN=Certificate Templates,CN=Public Key,CN=Services,CN=Configuration," will be prepended to this:
RCT_LDAPBASE="DC=example,DC=corp"
RCT_LDAPAUTHUNQUOTED="-x -w see#keepass"
RCT_LDAPAUTHQUOTED="-D CN=Service Account 319 (sa319),OU=Accounts,DC=example,DC=corp"

References

man openssl man x509

Query ldap CDP with ldapsearch

bgstack15 — Sat, 25 May 2024 13:21:55 GMT

Quick and dirty note for manual inspection of the CRL distribution point stored in LDAP (so primarily for M$ use cases).

ldapsearch -LLL -o ldif-wrap=9000 -H ldap://example.corp -b "CN=CA Name V3,CN=hostname,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=example,DC=corp" "(objectclass=cRLDistributionPoint)" -x -w "KEEPASS" -D "CN=Account,OU=Accounts,DC=example,DC=corp" certificateRevocationList | awk -F'::' '$1~/certificateRevocationList/{print $NF}' > ~/tmp1
{ printf '%s\n' '-----BEGIN X509 CRL-----' ; <~/tmp1 tr -d '\r\n ' | fold -w64 ; printf '\n%s' '-----END X509 CRL-----' ; } | openssl crl -in /dev/stdin -noout -text

References

python3 urllib3: ignore certificates

bgstack15 — Fri, 23 Feb 2024 14:08:54 GMT

In python3 urrlib3, when you set up a pool manager, you can tell it to use your ca cert bundle, or even just ignore certs.

import urrlib3
webpool = urllib3.PoolManager(cert_reqs="CERT_NONE")
webpool = urllib3.PoolManager(cert_reqs="CERT_REQUIRED",ca_certs="/path/to/cacerts.pem")

You can change the settings later too (but I haven't actually tested this yet!):

webpool.connection_pool_kw["cert_reqs"] = "CERT_NONE"

If you use certifi:

import certifi, urllib3
webpool = urllib3.PoolManager(ca_certs=certifi.where())

And also to suppress the warnings (HERE BE DRAGONS):

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

Use at my own risk.

Codesign Powershell script

bgstack15 — Mon, 22 Jan 2024 14:11:13 GMT

I work with some Powershell, and sometimes I even have to run Windows systems. Loading a function library was more complicated than it should have been, because I hadn't gotten my powershell script signed with a certificate. So here's how to do it with a valid cert.

$cert = (Get-ChildItem Cert:\localmachine\My -CodeSigningCert)[0]
Set-AuthenticodeSignature -File C:\Path\To\File.ps1 -Cert $cert -IncludeChain "All" -TimestampServer http://sha256timestamp.ws.symantec.com/sha256/timestamp

References

How to Sign Digitally PowerShell Script With Code Signing.