Lower certificate expiry severity for strong replacements

[ndemou]

Motivation

• Reduce noise and avoid high-severity expiry findings when a clearly suitable replacement certificate already exists.
• Treat a same-subject, same-issuer certificate that matches private-key capability and enhanced key usages as a strong replacement candidate rather than an uncertain replacement.
• Preserve the existing binding-check guidance: a candidate is not proof of migrated bindings, but can justify lowering the finding severity.

Description

• Added Get-CertExpiryEnhancedKeyUsageIds to normalize and compare enhanced key usage OIDs for certificates.
• Added Test-CertExpiryStrongReplacementCandidate to classify a candidate as a strong replacement when issuer, HasPrivateKey, and EKU sets match.
• Updated Get-CertExpiryReplacementCandidate to prefer strong candidates over longer-lived weak candidates and to surface a strong/weak decision when selecting a candidate.
• When a strong replacement candidate exists, the code lowers the finding severity by one level (FAILURE -> WARNING -> NOTICE) and records a Severity adjustment: line in the finding comments; expanded Pester coverage in tests/Unit/HealthTest-CertExpiry.Tests.ps1 to exercise these behaviors and candidate-preference logic.

Testing

• Ran repository sanity checks including git diff --check and local diffs to validate the changes (no diff-check failures).
• Attempted to run the unit suite with ./tests/run-unit-tests.ps1 via PowerShell, but Windows PowerShell (pwsh / PowerShell 5.1) was not available in this Linux container so the Pester tests were not executed here.
• Added focused Pester tests in tests/Unit/HealthTest-CertExpiry.Tests.ps1 covering: detection of a strong candidate and severity lowering, notice conversion for upcoming expiry, non-lowering when EKUs differ, and preferring a strong candidate over a longer-lived weak candidate (these tests should be executed on Windows PowerShell 5.1 as described in AGENTS.md).

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 33cc313cf9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Verify SAN and key usage before lowering severity

When two certificates share the subject, issuer, private-key capability, and EKUs but have different Subject Alternative Name or Key Usage extensions, this function still returns true even though the candidate may not support the original certificate's hostnames or cryptographic operations. That causes the caller to downgrade an imminent-expiry failure to a warning, or a warning to a notice, for a certificate that has no functionally compatible replacement; compare these usage-defining extensions before classifying the candidate as strong.

Useful? React with 👍 / 👎.