New-SelfSignedCertificate command appears to produce SSLv3 certificates instead of TLS 1.x

Steps to reproduce

New-SelfSignedCertificate -Subject blah

Expected behavior

PowerShell generates a TLS 1.3 certificate.

Actual behavior

PowerShell appears to generate an SSL v3 certificate.

Environment data

Name                           Value
----                           -----
PSVersion                      7.0.3
PSEdition                      Core
GitCommitId                    7.0.3
OS                             Microsoft Windows 10.0.19041
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[jborean93]

Everyone is ignorant about X509 and certificates, they are too complex for their own good 😃

[jborean93]

A certificate doesn’t state the protocol it is for, that’s up to the service/client to manage when creating the TLS pipeline. The Certificate just contains encryption and hashing information to facilitate the functions of TLS. The version is just the version of the X509 structure, V3 doesn’t mean SSL v3. The version tells the reader of the cert what fields can be contained and how it is structured.

Details of X509 version 3 can be found in RFC 5280. It is the latest version available so New-SelfSignedCertificate isn’t producing anything old.