Hello crypto world! One my colleague asked me about how to get certificate purposes property. Here is a little intro.

Certificate purposes are (mainly) limited by Enhanced Key Usages extension:

That is true. In certain cases it is reasonable to limit certificate purposes to a subset of purposes that are allowed in EKU extension. For example, in many and many CAs are allowed for any purpose (All Application Policies) and you can limit it's purposes to a limited set:

Note: these properties are available only when certificate is installed in the certificate store or PKCS#7/Serialized Store.

Almost all CA certificates in Trusted Root CAs container are limited in purposes by setting appropriate check-boxes in certificate properties. Since this is certificate property, you won't be able to find appropriate field in X509Certificate2 object.

Fortunately there is Windows PowerShell and CryptoAPI which can help here. We will use unmanaged CryptoAPI function called CertGetCertificateContextProperty in conjunction with property ID (PropID): CERT_ENHKEY_USAGE_PROP_ID (36).

As per description:

Returns an array of bytes that contain an ASN.1-encoded CERT_ENHKEY_USAGE structure. This structure contains an array of Enhanced Key Usage object identifiers (OIDs), each of which specifies a valid use of the certificate.

the function returns ASN.1 encoded byte array which contains EKU object identifiers. If the function returns False, then no properties are set (equals to Enable all purposes for this certificate option). If the function returns True and empty ASN.1 sequence, then it equals to Disable all purposes for this certificate option. If ASN.1 sequence is not empty, then certificate purposes are constrained. And here is a PowerShell script example:

function Get-CertificateEKUProperty {
[CmdletBinding()]
    param(
        [Parameter(Mandatory = $true)]
        [Security.Cryptography.X509Certificates.X509Certificate2]$Cert
    )
$signature = @"
[DllImport("Crypt32.dll", SetLastError = true, CharSet = CharSet.Auto)]
public static extern bool CertGetCertificateContextProperty(
    IntPtr pCertContext,
    uint dwPropId,
    Byte[] pvData,
    ref uint pcbData
);
"@
    Add-Type -MemberDefinition $signature -Namespace PKI -Name Crypt32
    # check if X509Certificate2 object is not empty
    if (!$Cert.Equals([IntPtr]::Zero)) {
        $pcbData = 0
        # if the function returns True, then certificate purposes are either disabled or constrained
        # otherwise (False) valid purposes are determined by certificate's EKU
        if ([PKI.Crypt32]::CertGetCertificateContextProperty($Cert.Handle,0x9,$null,[ref]$pcbData)) {
            # create a buffer for ASN.1 encoded byte array
            $pvData = New-Object byte[] -ArgumentList $pcbData
            # call the function again to write actual data
            [void][PKI.Crypt32]::CertGetCertificateContextProperty($Cert.Handle,0x9,$pvData,[ref]$pcbData)
            # instantiate AsnEncodedData object with ASN.1 encoded byte array
            $asn = New-Object Security.Cryptography.AsnEncodedData (,$pvData)
            # instaintiate X509EnhancedKeyUsageExtension to retrieve OIDs in a readable form
            $eku = New-Object Security.Cryptography.X509Certificates.X509EnhancedKeyUsageExtension $asn, $false
            # if none OIDs are defined, then all certificate purposes are explicitly disabled in the properties
            if ($eku.EnhancedKeyUsages.Count -eq 0) {
                Write-Warning "All purposes for this certificate are explicitly disabled."
            } else {
                # return constrained OIDs
                $eku.EnhancedKeyUsages
            }
        } else {Write-Warning "Valid purposes are determined by the certificate EKU extension."}
    } else {
        Write-Error -Category InvalidArgument -ErrorId "InvalidArgumentException" `

        -Message "An attempt was made to access an uninitialized object."
    }
}

The function accepts X509Certificate2 objects and returns OidCollection or appropriate warning messages. Here is an example:

PS C:\> Get-CertificateEKUProperty (dir cert:\CurrentUser\Root\02FA*)

Value                                                       FriendlyName
-----                                                       ------------
1.3.6.1.5.5.7.3.1                                           Server Authentication
1.3.6.1.5.5.7.3.2                                           Client Authentication
1.3.6.1.5.5.7.3.4                                           Secure Email
1.3.6.1.5.5.7.3.3                                           Code Signing
1.3.6.1.5.5.7.3.8                                           Time Stamping
1.3.6.1.4.1.311.10.3.4                                      Encrypting File System
1.3.6.1.5.5.7.3.6                                           IP security tunnel termination
1.3.6.1.5.5.7.3.7                                           IP security user


PS C:\> Get-CertificateEKUProperty (dir cert:\CurrentUser\Root\1941A*)
WARNING: Valid purposes are determined by the certificate EKU extension.
PS C:\> Get-CertificateEKUProperty (dir cert:\CurrentUser\My\D48*)
WARNING: All purposes for this certificate are explicitly disabled.
PS C:\>

HTH.