CertificateDsc icon indicating copy to clipboard operation
CertificateDsc copied to clipboard

xCertReq: Permit ECDH key-lengths

Open mhenderson-so opened this issue 7 years ago • 1 comments

Details of the scenario you tried and the problem that is occurring: When attempting to use xCertReq to request an ECDH certificate, you typically use a key length of 192, 224, 256, 384 or 521. Currently if you try to specify one of those key lengths, the module throws an error of:

At least one of the values '256' is not supported or valid for property 'KeyLength' on class 'xCertReq'. Please
specify only supported values:
1024, 2048, 4096, 8192.

Patching this in for a one-off is simple enough, but it is a "dumb" patch that permits any of the key sizes for any of the certificates, even if they are not valid for that certificate type. Maybe that's a valid workaround for this module? If so, more than happy to provide a PR.

E.g. RSA keys should have 1024, 2048, 4096, 8192, but EDCH keys should have 192, 224, 256, 384, 521

Version of the Operating System and PowerShell the DSC Target Node is running: Windows Server 2016, PSVersion 5.1.14393.1884

Version of the DSC module you're using, or 'dev' if you're using current dev branch: 3.0.0.0

mhenderson-so avatar Dec 06 '17 15:12 mhenderson-so

Hi @mhenderson-so - good call out.

I think the best method is for the parameter to support all the available key sizes for RSA and EDCH keys but we will need to create an Assert-ResourceProperty function that will be called inside Test-TargetResource and Set-TargetResource that will validate the parameter combination.

I'll take a look at implementing this over this weekend.

PlagueHO avatar Dec 07 '17 07:12 PlagueHO