AppInsight For iis (SSL Certificate Monitor)

Hi All,

received this from support Case # - 01777158.

As checked, unfortunately, there is no way to change the location to check by the component, only port can be specified in the configuration of component. You may try using below component SSL Certificate expiration date monitor and see if it works.

Find more posts tagged with

iis

WMI

application_monitor

Accepted answers

All comments

chad.every

@RAJPAD This is available if you use the SSL Certificate Monitor Component feature. It does sit outside of the AppInsight for IIS template. a couple of SSL certificate enhancements have been implemented in 2025.2. See the 2025.5 RC Blog for more details. The RC is available in the SolarWinds Customer Portal.

SteveK

I ended up going a different route for IIS Cert Monitoring. I ran into the issue where ports were changed or users failed to setup the monitors correctly. So I ended up creating a powershell based monitor that basically grabs the bindings, then does a lookup for the cert against the local machine store. If there are sites you want to exclude, you could add them in at the script argument section.

I broke them up into Total Certs, Warning (expiring within 30 days), Critical (expiring within 7 days) and Expired.

#Sanatize Variables
    Clear-Variable Results -ErrorAction SilentlyContinue
    Clear-Variable Sites,Bindings,Certificates -ErrorAction SilentlyContinue
    Clear-Variable WarningCert,CriticalCert,ExpiredCert -ErrorAction SilentlyContinue

#Load Module
    Try {
        Import-Module WebAdministration
    } Catch {
        Write-Host "Message:  failed to load WebAdministration module"
        Exit 1
    }

#Build Exclusion List
    If ([String]::IsNullOrWhiteSpace($Args) -eq $False) {
        $Exclusions = $Args
    }

#Set variables for expiration
    $WarningDate = (Get-Date).AddDays(30)
    $CriticalDate = (Get-Date).AddDays(7)

#Retrieve Sites
    Try{
                Switch ([String]::IsNullOrWhiteSpace($Exclusions)) {
            "TRUE" {
                $Sites = Get-ChildItem IIS:\Sites\* -ErrorAction Stop
                Write-Host "Message.ExcludedSites:  None"
                Write-Host "Statistic.ExcludedSites:  0"
            }
            "FALSE" {
                $Sites = Get-ChildItem IIS:\Sites\* -ErrorAction Stop  | Where-Object {$_.State -eq "Started" -and $_.Name -notin $Exclusions}
                Write-Host "Message.ExcludedSites:  $($Exclusions -Join ",")"
                Write-Host "Statistic.ExcludedSites:  $(($Exclusions | Measure-Object).count)"
            }
        }
    } Catch {
        Write-Host "Message: failed to retrieve sites"
        exit 1
    }

#Retrieve Bindings
    Try{
        $Bindings = Get-ChildItem IIS:\SSLBindings -ErrorAction Stop | Where-Object {$Sites.Name -contains $_.Sites.Value}
    } Catch {
        Write-Host "Message: failed to retrieve AppPools"
        exit 1
    }

#Retrieve Cert Info
    Try {
        $Certificates = Get-ChildItem CERT:LocalMachine/My -ErrorAction Stop | Where-Object {$Bindings.thumbprint -contains $_.Thumbprint}
    } Catch {
        Write-Host "Message: failed to retrieve certificates"
    }

#Total Cert information
    If ([String]::IsNullOrEmpty($Certificates)) {
        Write-Host "Statistic.TotalCerts: 0"
        Write-Message "Message.TotalCerts:  Unable to retrieve certificates"
        Exit 0
    }

    Write-Host "Statistic.TotalCerts: $(($Certificates | Measure-Object).Count)"

#Warning - 30 days
    $WarningCert = $Certificates | Where-Object {$_.NotAfter -lt $WarningDate}

    If ([String]::IsNullOrEmpty($WarningCert)) {
        Write-Host "Statistic.WarningExpiration: 0"
        Write-Host "Message.WarningExpiration:  No certs expiring in 30 days"
    } Else {
        Write-Host "Statistic.WarningExpiration: $(($WarningCert | Measure-Object).count)"

        If (($WarningCert | Measure-Object).Count -gt 0) {
            Write-Host "Message.WarningExpiration: Certs expiring in 30 days.  $($WarningCert.FriendlyName -join ";")"
        } Else {
            Write-Host "Message.WarningExpiration: No certs expiring in 30 days"
        }

    }

#Critical - 7 days
    $CriticalCert = $Certificates | Where-Object {$_.NotAfter -lt $CriticalDate}

    If ([String]::IsNullOrEmpty($CriticalCert)) {
        Write-Host "Statistic.CriticalExpiration: 0"
        Write-Host "Message.CriticalExpiration:  No certs expiring in 7 days"
    } Else {
        Write-Host "Statistic.CriticalExpiration: $(($CriticalCert | Measure-Object).count)"

        If (($CriticalCert | Measure-Object).Count -gt 0) {
            Write-Host "Message.CriticalExpiration: Certs expiring in 7 days.  $($CriticalCert.FriendlyName -join ";")"
        } Else {
            Write-Host "Message.CriticalExpiration: No certs expiring in 7 days"
        }

    }

#Expired
    $ExpiredCert = $Certificates | Where-Object {$_.NotAfter -lt (Get-Date)}

    If ([String]::IsNullOrEmpty($ExpiredCert)) {
        Write-Host "Statistic.Expired: 0"
        Write-Host "Message.Expired:  No certs expired"
    } Else {
        Write-Host "Statistic.Expired: $(($ExpiredCert | Measure-Object).count)"

        If (($ExpiredCert | Measure-Object).Count -gt 0) {
            Write-Host "Message.Expired: Certs expired.  $($CriticalCert.FriendlyName -join ";")"
        } Else {
            Write-Host "Message.Expired: No certs expired"
        }

    }

#Retrieves the earliest expiration date
$Closest = ($Certificates | Select-Object FriendlyName,NotAfter | Sort-Object -property NotAfter)[0]
$ClosestTime = $Closest.NotAfter - (Get-Date)
If ($ClosestTime.Days -ge 0) {
Write-Host "Message.EarliestExpiration: $($Closest.FriendlyName) expires in $($ClosestTime.days) days"
} Else {
Write-Host "Message.EarliestExpiration:  $($Closest.FriendlyName) expired $([Math]::Abs($ClosestTime.days)) days ago"
}
Write-Host "Statistic.EarliestExpiration: $($ClosestTime.Days)"
Exit 0

HillyBilly

Hi,

Here the link to the way I resolved the issue.

The page gives you some guidance on how to monitor IIS and how to get a report as well. you can then schedule the report to find out what SSL Certs are about to expiry.

IIS Website certificates information and report monitoring - Forum - Server & Application Monitor (SAM) - THWACK

Here's one for SQL Certs.
SQL Instance SSL Certificate monitoring and report - Forum - Server & Application Monitor (SAM) - THWACK

and if you have a network device / appliance / apache TomCat / WebLogic / External Sites
Monitor Appliance and Website certificate expiration date - Application Monitor Templates - Server & Application Monitor - THWACK