How to check if a certificate .pfx file has code signing ability (EKU)?

NTDEV
1

Is there anyway to tell if a .pfx file in windows has the code signing ability using command or writing a program?

Code signing ability is added to the certificate via an EKU, so how to check this?

More specifically, kernel mode code signing ability.

2

Isn’t this indicated by an OID in the X509v3 Extended Key Usage thingy?

Peter

3

@“Peter_Viscarola_(OSR)” said:
Isn’t this indicated by an OID in the X509v3 Extended Key Usage thingy?

Peter

I Think so, but is there any simple command that can show me important features regarding the pfx file, including whether it has code signing EKU or not?
Maybe a cmd or powershell command, or a signtool command? or any open source tool that parses the pfx file format?

4

The openssl command can certainly do it. That’s one of those commands with a billion subcommands; it can do anything, if you can figure out how to spell it. If you import it with certmgr, you can examine the details and find the usages.

1 Like
5

openssl pkcs12 -info -in my.pfx

1 Like