Repository: PowerShell/PowerShell
File: src/Microsoft.PowerShell.Security/security/CertificateProvider.cs (C#)

Code before:
                unicodeName = idnMapping.GetUnicode(dnsName);
            }
            catch (ArgumentException)
            {
                // The name is not valid Punycode, assume it's valid ASCII.
                unicodeName = dnsName;
            }

            return new DnsNameRepresentation(dnsName, unicodeName);
        }

        /// <summary>
        /// Constructor for DnsNameProperty.
        /// </summary>
        public DnsNameProperty(X509Certificate2 cert)
        {
            _dnsList = new List<DnsNameRepresentation>();

            // extract DNS name from subject distinguish name
            // if it exists and does not contain a comma
            // a comma, indicates it is not a DNS name
            if (cert.Subject.StartsWith(distinguishedNamePrefix, System.StringComparison.OrdinalIgnoreCase) &&
                !cert.Subject.Contains(','))
            {
                string parsedSubjectDistinguishedDnsName = cert.Subject.Substring(distinguishedNamePrefix.Length);
                DnsNameRepresentation dnsName = GetDnsNameRepresentation(parsedSubjectDistinguishedDnsName);
                _dnsList.Add(dnsName);
            }

            // Extract DNS names from SAN extensions
            foreach (X509Extension extension in cert.Extensions)
            {
                if (extension is X509SubjectAlternativeNameExtension sanExtension)
                {
                    foreach (string dnsNameEntry in sanExtension.EnumerateDnsNames())
                    {
                        DnsNameRepresentation dnsName = GetDnsNameRepresentation(dnsNameEntry);

                        // Only add the name if it is not the same as an existing name.
                        if (!_dnsList.Contains(dnsName))
                        {
                            _dnsList.Add(dnsName);
                        }
                    }
                }
            }
        }
    }

    /// <summary>
    /// Downlevel helper function to determine if the OS is WIN8 and above.

Review comment (security):
@iSazonov I wonder if this can also be replaced with https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x500distinguishedname.enumeraterelativedistinguishednames?view=net-9.0.

I don't think even distinguished name needs string parsing anymore.

Code after:
                unicodeName = idnMapping.GetUnicode(dnsName);
            }
            catch (ArgumentException)
            {
                // The name is not valid Punycode, assume it's valid ASCII.
                unicodeName = dnsName;
            }

            return new DnsNameRepresentation(dnsName, unicodeName);
        }

        /// <summary>
        /// Constructor for DnsNameProperty.
        /// </summary>
        public DnsNameProperty(X509Certificate2 cert)
        {
            _dnsList = new List<DnsNameRepresentation>();

            // extract DNS name from subject distinguish name
            // if it exists and does not contain a comma
            // a comma, indicates it is not a DNS name
            if (cert.Subject.StartsWith(distinguishedNamePrefix, StringComparison.OrdinalIgnoreCase) &&
                !cert.Subject.Contains(','))
            {
                string parsedSubjectDistinguishedDnsName = cert.Subject.Substring(distinguishedNamePrefix.Length);
                DnsNameRepresentation dnsName = GetDnsNameRepresentation(parsedSubjectDistinguishedDnsName);
                _dnsList.Add(dnsName);
            }

            // Extract DNS names from SAN extensions
            foreach (X509Extension extension in cert.Extensions)
            {
                if (extension is X509SubjectAlternativeNameExtension sanExtension)
                {
                    foreach (string dnsNameEntry in sanExtension.EnumerateDnsNames())
                    {
                        DnsNameRepresentation dnsName = GetDnsNameRepresentation(dnsNameEntry);

                        // Only add the name if it is not the same as an existing name.
                        if (!_dnsList.Contains(dnsName))
                        {
                            _dnsList.Add(dnsName);
                        }
                    }
                }
            }
        }
    }

    /// <summary>
    /// Downlevel helper function to determine if the OS is WIN8 and above.