Post

Azure Artifact Signing introduced a stable publisher id inside the certificate that is *perfect* for pinning, but Microsoft didn't follow through. There are no easy ways to inspect this publisher id, either through the GUI, Win32 APIs or PowerShell commands

26/10/26, 6:30 pm0 reposts3 likes

Jordan Borean

@jborean.bsky.social

Not sure they really could do it without antitrust concerns. I'm also unsure if you can really pin just on this EKU entry, you would have to also trust the issuer is expected to use that OID as anyone can issue a cert with any EKU OIDs they want.

Marc-André Moreau

@awakecoding.com

You need to pin both the publisher ID and the Microsoft CAs. Only Microsoft CAs are supposed to use this special publisher ID encoded in the EKU OIDs, there's no reason to see it with third-party CAs not used in Azure Artifact Signing

Jordan Borean

@jborean.bsky.social

Because this is around trust you need something else to say yes I trust the EKU entries are valid. Any CA can issue a cert with these values so it’s a question of whether you blindly trust it or use some other marker to say the EKUs can be trusted and display what it represents.

Jordan Borean

@jborean.bsky.social

I don’t have a good answer for that question, maybe it is safe to assume but considering this is all about trust I would be surprised if it was safe to do so. I also think that the cert viewer isn’t the right place to display this information. It belongs on the signature/authenticode tab.