Powershell: New-SelfSignedCertificate command appears to produce SSLv3 certificates instead of TLS 1.x

[pcgeek86]

Steps to reproduce

New-SelfSignedCertificate -Subject blah

Expected behavior

PowerShell generates a TLS 1.3 certificate.

Actual behavior

PowerShell appears to generate an SSL v3 certificate.

Environment data

Name                           Value
----                           -----
PSVersion                      7.0.3
PSEdition                      Core
GitCommitId                    7.0.3
OS                             Microsoft Windows 10.0.19041
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[vexx32]

This may depend on your SSL settings in the system/registry and in process.

Try setting [Net.ServicePointManager]::SecurityProcol = 'Tls12' and try again perhaps?

[pcgeek86]

I just tried setting it to Tls13 and it still shows a "v3" certificate.

Here's the one I generated earlier this morning. Forgot to post screenshot to OP.

As you can see, they're both "v3" certs. I presume that means SSLv3?

[vexx32]

No idea there, I'm afraid. Perhaps the Windows documentation somewhere has some information on what that Version refers to. Generally speaking though I'd be surprised if that refers to SSLv3, which hasn't been in common use in quite a long time. My guess would be it has something to do with the version of the hashing algorithms used to generate the keys.

[pcgeek86]

Yeah, that's possible. Next question is: how do I verify the certificate type (SSLv3 vs. TLS 1.1, 1.2, 1.3)?

[jborean93]

A certificate doesn't state the protocol it is for, that's up to the service/client to manage when creating the TLS pipeline. The Certificate just contains encryption and hashing information to facilitate the functions of TLS. The version is just the version of the X509 structure, V3 doesn't mean SSL v3. The version tells the reader of the cert what fields can be contained and how it is structured.

Details of X509 version 3 can be found in RFC 5280. It is the latest version available so New-SelfSignedCertificate isn't producing anything old.

[pcgeek86]

Ah good point. My ignorance is showing. :)

[jborean93]

Everyone is ignorant about X509 and certificates, they are too complex for their own good :)

[vexx32]

Can confirm, had no dang clue what all that stuff means 😂