Problem
You want to retrieve information about certificates for the current user or local machine.
Solution
To browse and retrieve certificates on the local machine, use PowerShell’s certificate drive. This drive is created by the certificate provider, as shown in Example 165.
Example 165. Exploring certificates in the certificate provider
PS >SetLocation cert:\CurrentUser\ PS >$cert = GetChildItem Rec CodeSign PS >$cert | FormatList
Subject : CN=PowerShell User Issuer : CN=PowerShell Local Certificate Root Thumbprint : FD48FAA9281A657DBD089B5A008FAFE61D3B32FD FriendlyName : NotBefore : 4/22/2007 12:32:37 AM NotAfter : 12/31/2039 3:59:59 PM Extensions : {System.Security.Cryptography.Oid, System.Security.Cryptogr
aphy.Oid}
Discussion
The certificate drive provides a useful way to navigate and view certificates for the current user or local machine. For example, if your execution policy requires the use of digital signatures, the following command tells you which publishers are trusted to run scripts on your system:
GetChildItem cert:\CurrentUser\TrustedPublisher
The certificate provider is probably most commonly used to select a codesigning certificate for the SetAuthenticodeSignature cmdlet. The following command selects the “best” code signing certificate—that being the one that expires last:
$certificates = GetChildItem Cert:\CurrentUser\My CodeSign $signingCert = @($certificates | Sort Desc NotAfter)[0] In this CodeSign parameter lets you search for certificates in the certificate store that support code signing.
Although the certificate provider is useful for browsing and retrieving information from the computer’s certificate stores, it does not lets you add or remove items from these locations. If you want to manage certificates in the certificate store, the System.Security.Cryptography.X509Certificates.X509Store class (and other related classes from the System.Security.Cryptography.X509Certificates namespace) from the .NET Framework support that functionality.
For more information about the certificate provider, type GetHelp Certificate.
