Post

Azure Artifact Signing introduced a stable publisher id inside the certificate that is *perfect* for pinning, but Microsoft didn't follow through. There are no easy ways to inspect this publisher id, either through the GUI, Win32 APIs or PowerShell commands

Not sure they really could do it without antitrust concerns. I'm also unsure if you can really pin just on this EKU entry, you would have to also trust the issuer is expected to use that OID as anyone can issue a cert with any EKU OIDs they want.

You need to pin both the publisher ID and the Microsoft CAs. Only Microsoft CAs are supposed to use this special publisher ID encoded in the EKU OIDs, there's no reason to see it with third-party CAs not used in Azure Artifact Signing

Because this is around trust you need something else to say yes I trust the EKU entries are valid. Any CA can issue a cert with these values so it’s a question of whether you blindly trust it or use some other marker to say the EKUs can be trusted and display what it represents.

I don’t have a good answer for that question, maybe it is safe to assume but considering this is all about trust I would be surprised if it was safe to do so. I also think that the cert viewer isn’t the right place to display this information. It belongs on the signature/authenticode tab.

I wrote Get-AzTrustedSigningEkuOid github.com/jborean93/Po... to extract this from a cert. It probably should be updated to also compare something up the chain is the same to convey that it came from the same source but I just don't know. In PKI not knowing is dangerous when doing stuff like this :)