feat(detection): distinguish CA-shaped schema v1 templates in SchemaV1 findings - #101
Merged
Merged
Conversation
…1 findings - add IsCATemplate property (pKIDefaultKeySpec -eq 2) via new Set-IsCATemplate, wired into Initialize-AdcsObjectStore - add Get-IssueTextOverride: generic Overrides mechanism (When property-equality → alternate Issue/Fix/Revert text) - migrate SchemaV1 CAOverride to Overrides; CA templates get leave-in-place guidance instead of supersession (#98) - tests: 4 Set-IsCATemplate, 6 Get-IssueTextOverride, 3 SchemaV1 CA-branch; 637/637 pass PS 7 (PS 5.1 failures pre-existing PSCertutil/PSWriteHTML stubs)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Distinguishes CA-shaped schema v1 certificate templates from end-entity schema v1 templates and emits remediation guidance appropriate to each. Closes #98.
IsCATemplateproperty onLS2AdcsObject, populated by newSet-IsCATemplate(pKIDefaultKeySpec -eq 2/AT_SIGNATURE), wired into theInitialize-AdcsObjectStoretemplate pipeline.Get-IssueTextOverride: generic override mechanism. Any technique may now carry anOverridesarray; each entry has aWhencondition (single property equality) plus alternateIssueTemplate/FixTemplate/RevertTemplate. First match wins; no match falls back to the base technique text.CAOverridemigrated toOverridesas the mechanism's first consumer. CA-shaped templates get leave-in-place guidance — replacing SubCA certificates requires planning and testing, not simple supersession. End-entity templates keep the existing supersession guidance.Why
Supersession has not been observed to work reliably for CA templates in live environments, so recommending it for CA-shaped schema v1 templates was misleading guidance (reported by @thedxt, #98).
Test plan
Set-IsCATemplatetests, 6Get-IssueTextOverridetests, 3 SchemaV1 CA-branch tests.Set-CA*(PSCertutil mocks) andNew-LS2Dashboard(PSWriteHTML) — verified pre-existing by running the baseline tree with changes stashed.