在上一行找到值后，Powershell 正则表达式 return 一行的一部分
Powershell regex to return a part of a line after finding a value on a previous line
我正在尝试审核证书过期时间，我想从 Java 密钥库中获取特定证书的过期日期。
证书顺序可能会更改，因此我需要在特定密钥库别名之后获取到期行。
示例密钥库：
Keystore type: jks
Keystore provider: SUN
Your keystore contains 2 entries
Alias name: one
Creation date: Apr 25, 2010
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=host.domain.com, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Issuer: CN=Alvin Alexander, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Serial number: 4bd4e793
Valid from: Mon Apr 25 17:08:35 AKDT 2017 until: Mon Jul 24 17:08:35 AKDT 2019
Certificate fingerprints:
MD5: 55:20:B2:68:FD:0F:4E:BF:D5:E5:D5:04:47:6C:E3:10
SHA1: 25:17:A0:CA:86:CC:3E:6C:2D:C0:4E:8D:E8:33:05:F7:4B:50:FE:E5
*******************************************
*******************************************
Alias name: two
Creation date: Apr 25, 2015
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=Alvin Alexander, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Issuer: CN=Alvin Alexander, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Serial number: 4bd4e793
Valid from: Tues Apr 25 17:08:35 AKDT 2010 until: Tues Jul 24 17:08:35 AKDT 2025
Certificate fingerprints:
MD5: 55:20:B2:68:FD:0F:4E:BF:D5:E5:D5:04:47:6C:E3:10
SHA1: 25:17:A0:CA:86:CC:3E:6C:2D:C0:4E:8D:E8:33:05:F7:4B:50:FE:E5
*******************************************
*******************************************
Alias name: three
Creation date: Apr 25, 2010
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=host.domain.com, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Issuer: CN=Alvin Alexander, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Serial number: 4bd4e793
Valid from: Wed Apr 25 17:08:35 AKDT 2030 until: Wed Jul 24 17:08:35 AKDT 2035
Certificate fingerprints:
MD5: 55:20:B2:68:FD:0F:4E:BF:D5:E5:D5:04:47:6C:E3:10
SHA1: 25:17:A0:CA:86:CC:3E:6C:2D:C0:4E:8D:E8:33:05:F7:4B:50:FE:E5
*******************************************
*******************************************
所以我想 return "Wed Jul 24 17:08:35 AKDT 2035" 来自证书 'three'。
本质上，正则表达式需要 return 在 'Valid from:' 行的 'until:' 之后的数据，在它看到证书别名后：'three'
我正在使用 powershell 执行此操作并且我有以下内容：
(?<=three)(?:.*?)(?:Until:\s)(\s*.*)
上面的方法失败了，因为我正试图在另一条线上积极回顾。如果我在同一条线上向后看，它会起作用：
(?<=Wed)(?:.*?)(?:Until:\s)(\s*.*)
我已经看了几个小时了，但还是想不通！
这是使用 Select-String 和 context 参数的另一种方法：
$c = Get-Content c:\temp\certs.txt
$three = $c |Select-String "alias name: three" -Context 8
$expirity = [regex]::Match($three.Context.DisplayPostContext[7],"until:(.*)").value.split(':')[1]
我正在尝试审核证书过期时间，我想从 Java 密钥库中获取特定证书的过期日期。
证书顺序可能会更改，因此我需要在特定密钥库别名之后获取到期行。
示例密钥库：
Keystore type: jks
Keystore provider: SUN
Your keystore contains 2 entries
Alias name: one
Creation date: Apr 25, 2010
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=host.domain.com, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Issuer: CN=Alvin Alexander, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Serial number: 4bd4e793
Valid from: Mon Apr 25 17:08:35 AKDT 2017 until: Mon Jul 24 17:08:35 AKDT 2019
Certificate fingerprints:
MD5: 55:20:B2:68:FD:0F:4E:BF:D5:E5:D5:04:47:6C:E3:10
SHA1: 25:17:A0:CA:86:CC:3E:6C:2D:C0:4E:8D:E8:33:05:F7:4B:50:FE:E5
*******************************************
*******************************************
Alias name: two
Creation date: Apr 25, 2015
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=Alvin Alexander, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Issuer: CN=Alvin Alexander, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Serial number: 4bd4e793
Valid from: Tues Apr 25 17:08:35 AKDT 2010 until: Tues Jul 24 17:08:35 AKDT 2025
Certificate fingerprints:
MD5: 55:20:B2:68:FD:0F:4E:BF:D5:E5:D5:04:47:6C:E3:10
SHA1: 25:17:A0:CA:86:CC:3E:6C:2D:C0:4E:8D:E8:33:05:F7:4B:50:FE:E5
*******************************************
*******************************************
Alias name: three
Creation date: Apr 25, 2010
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=host.domain.com, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Issuer: CN=Alvin Alexander, OU=Application Development, O=devdaily.com, L=Louisville, ST=KY, C=US
Serial number: 4bd4e793
Valid from: Wed Apr 25 17:08:35 AKDT 2030 until: Wed Jul 24 17:08:35 AKDT 2035
Certificate fingerprints:
MD5: 55:20:B2:68:FD:0F:4E:BF:D5:E5:D5:04:47:6C:E3:10
SHA1: 25:17:A0:CA:86:CC:3E:6C:2D:C0:4E:8D:E8:33:05:F7:4B:50:FE:E5
*******************************************
*******************************************
所以我想 return "Wed Jul 24 17:08:35 AKDT 2035" 来自证书 'three'。
本质上，正则表达式需要 return 在 'Valid from:' 行的 'until:' 之后的数据，在它看到证书别名后：'three'
我正在使用 powershell 执行此操作并且我有以下内容：
(?<=three)(?:.*?)(?:Until:\s)(\s*.*)
上面的方法失败了，因为我正试图在另一条线上积极回顾。如果我在同一条线上向后看，它会起作用：
(?<=Wed)(?:.*?)(?:Until:\s)(\s*.*)
我已经看了几个小时了，但还是想不通！
这是使用 Select-String 和 context 参数的另一种方法：
$c = Get-Content c:\temp\certs.txt
$three = $c |Select-String "alias name: three" -Context 8
$expirity = [regex]::Match($three.Context.DisplayPostContext[7],"until:(.*)").value.split(':')[1]