PowerShell · daxian-dbw · Feb 10, 2026 · Oct 20, 2025 · Oct 20, 2025 · Oct 20, 2025
@@ -185,6 +185,11 @@ public string Path
         /// </summary>
         public bool IsOSBinary { get; internal set; }
 
+        /// <summary>
+        /// Gets the Subject Alternative Name from the signer certificate.
+        /// </summary>
+        public string[] SubjectAlternativeName { get; private set; }
+
         /// <summary>
         /// Constructor for class Signature
         ///
@@ -277,6 +282,9 @@ private void Init(string filePath,
             _statusMessage = GetSignatureStatusMessage(isc,
                                                       error,
                                                       filePath);
+
+            // Extract Subject Alternative Name from the signer certificate
+            SubjectAlternativeName = GetSubjectAlternativeName(signer);
         }
 
         private static SignatureStatus GetSignatureStatusFromWin32Error(DWORD error)
@@ -389,5 +397,34 @@ private static string GetSignatureStatusMessage(SignatureStatus status,
 
             return message;
         }
+
+        /// <summary>
+        /// Extracts the Subject Alternative Name from the certificate.
+        /// </summary>
+        /// <param name="certificate">The certificate to extract SAN from.</param>
+        /// <returns>Array of SAN entries or null if not found.</returns>
+        private static string[] GetSubjectAlternativeName(X509Certificate2 certificate)
+        {
+            if (certificate == null)
+            {
+                return null;
+            }
+
+            foreach (X509Extension extension in certificate.Extensions)
+            {
+                if (extension.Oid != null && extension.Oid.Value == CertificateFilterInfo.SubjectAlternativeNameOid)
+                {
+                    string formatted = extension.Format(multiLine: true);
+                    if (string.IsNullOrEmpty(formatted))
+                    {
+                        return null;
+                    }
+
+                    return formatted.Split(new[] { "\r\n", "\n", "\r" }, StringSplitOptions.RemoveEmptyEntries);
+                }
+            }
+
+            return null;
+        }
     }
 }
@@ -815,6 +815,7 @@ internal DateTime Expiring
         // The OID arc 1.3.6.1.4.1.311.80 is assigned to PowerShell. If we need
         // new OIDs, we can assign them under this branch.
         internal const string DocumentEncryptionOid = "1.3.6.1.4.1.311.80.1";
+        internal const string SubjectAlternativeNameOid = "2.5.29.17";
     }
 }
 

@@ -18,6 +18,9 @@ Describe "Windows platform file signatures" -Tags 'Feature' {
         $signature | Should -Not -BeNullOrEmpty
         $signature.Status | Should -BeExactly 'Valid'
         $signature.SignatureType | Should -BeExactly 'Catalog'
+
+        # Verify that SubjectAlternativeName property exists
+        $signature.PSObject.Properties.Name | Should -Contain 'SubjectAlternativeName'
     }
 }
 
@@ -185,4 +188,102 @@ Describe "Windows file content signatures" -Tags @('Feature', 'RequireAdminOnWin
         $actual.SignerCertificate.Thumbprint | Should -Be $certificate.Thumbprint
         $actual.Status | Should -Be 'Valid'
     }
+
+    It "Verifies SubjectAlternativeName is populated for certificate with SAN" {
+        $session = New-PSSession -UseWindowsPowerShell
+        try {
+            $sanThumbprint = Invoke-Command -Session $session -ScriptBlock {
+                $testPrefix = 'SelfSignedTestSAN'
+
+                $enhancedKeyUsage = [Security.Cryptography.OidCollection]::new()
+                $null = $enhancedKeyUsage.Add('1.3.6.1.5.5.7.3.3')
+
+                $caParams = @{
+                    Extension         = @(
+                        [Security.Cryptography.X509Certificates.X509BasicConstraintsExtension]::new($true, $false, 0, $true),
+                        [Security.Cryptography.X509Certificates.X509KeyUsageExtension]::new('KeyCertSign', $false),
+                        [Security.Cryptography.X509Certificates.X509EnhancedKeyUsageExtension]::new($enhancedKeyUsage, $false)
+                    )
+                    CertStoreLocation = 'Cert:\CurrentUser\My'
+                    NotAfter          = (Get-Date).AddDays(1)
+                    Type              = 'Custom'
+                }
+                $sanCA = PKI\New-SelfSignedCertificate @caParams -Subject "CN=$testPrefix-CA"
+
+                $rootStore = Get-Item -Path Cert:\LocalMachine\Root
+                $rootStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
+                try {
+                    $rootStore.Add([System.Security.Cryptography.X509Certificates.X509Certificate2]::new($sanCA.RawData))
+                } finally {
+                    $rootStore.Close()
+                }
+
+                $certParams = @{
+                    CertStoreLocation = 'Cert:\CurrentUser\My'
+                    KeyUsage          = 'DigitalSignature'
+                    TextExtension     = @(
+                        "2.5.29.37={text}1.3.6.1.5.5.7.3.3",
+                        "2.5.29.19={text}",
+                        "2.5.29.17={text}DNS=test.example.com&DNS=*.example.com"
+                    )
+                    Type              = 'Custom'
+                }
+                $sanCert = PKI\New-SelfSignedCertificate @certParams -Subject "CN=$testPrefix-Signed" -Signer $sanCA
+
+                $publisherStore = Get-Item -Path Cert:\LocalMachine\TrustedPublisher
+                $publisherStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
+                try {
+                    $publisherStore.Add([System.Security.Cryptography.X509Certificates.X509Certificate2]::new($sanCert.RawData))
+                } finally {
+                    $publisherStore.Close()
+                }
+
+                $sanCA | Remove-Item
+                $sanCA.Thumbprint, $sanCert.Thumbprint
+            }
+        } finally {
+            $session | Remove-PSSession
+        }
+
+        $sanCARootThumbprint = $sanThumbprint[0]
+        $sanCertThumbprint = $sanThumbprint[1]
+        $sanCertificate = Get-Item -Path Cert:\CurrentUser\My\$sanCertThumbprint
+
+        try {
+            Set-Content -Path testdrive:\test.ps1 -Value 'Write-Output "Test SAN"' -Encoding UTF8NoBOM
+
+            $scriptPath = Join-Path $TestDrive test.ps1
+            $status = Set-AuthenticodeSignature -FilePath $scriptPath -Certificate $sanCertificate
+            $status.Status | Should -Be 'Valid'
+
+            $actual = Get-AuthenticodeSignature -FilePath $scriptPath
+            $actual.SubjectAlternativeName | Should -Not -BeNullOrEmpty
+            ,$actual.SubjectAlternativeName | Should -BeOfType [string[]]
+            $actual.SubjectAlternativeName.Count | Should -Be 2
+            $actual.SubjectAlternativeName[0] | Should -BeExactly 'DNS Name=test.example.com'
+            $actual.SubjectAlternativeName[1] | Should -BeExactly 'DNS Name=*.example.com'
+        } finally {
+            Remove-Item -Path "Cert:\LocalMachine\Root\$sanCARootThumbprint" -Force -ErrorAction Ignore
+            Remove-Item -Path "Cert:\LocalMachine\TrustedPublisher\$sanCertThumbprint" -Force -ErrorAction Ignore
+            Remove-Item -Path "Cert:\CurrentUser\My\$sanCertThumbprint" -Force -ErrorAction Ignore
+        }
+    }
+
+    It "Verifies SubjectAlternativeName is null when certificate has no SAN" {
+        Set-Content -Path testdrive:\test.ps1 -Value 'Write-Output "Test No SAN"' -Encoding UTF8NoBOM
+
+        $scriptPath = Join-Path $TestDrive test.ps1
+        $status = Set-AuthenticodeSignature -FilePath $scriptPath -Certificate $certificate
+        $status.Status | Should -Be 'Valid'
+
+        $actual = Get-AuthenticodeSignature -FilePath $scriptPath
+        $actual.SignerCertificate.Thumbprint | Should -Be $certificate.Thumbprint
+        $actual.Status | Should -Be 'Valid'
+
+        # Verify that SubjectAlternativeName property exists
+        $actual.PSObject.Properties.Name | Should -Contain 'SubjectAlternativeName'
+
+        # Verify the content is null when certificate has no SAN extension
+        $actual.SubjectAlternativeName | Should -BeNullOrEmpty
+    }
 }