Monitoring multiple certificates that aren't in IIS

Question

Does anyone have any tips for monitoring against the certificate store in Windows? We have a number of services that require certificates, but they aren't imported to IIS so AppInsight can't be used. The Certificate Monitor only returns the dates for one certificate, so how do I report on the expiration dates for multiple? In theory we could get an alert that "certificate A" is going to expire in 60 days, but we would have no idea that "certificate B" could also be expiring in 61 days.

orioncrack · Answer

Well.....I manage 12 different SCOM environments for several companies

with one that has 1200+ servers alone. It's very simple compared to SAM but I'm not here to argue.

When SAM is able to automate certificate discovery, monitoring and alerting the way SCOM does it then that will be a happy fun day. Until then, it's a kludgey messy nightmare.

nickzourdos · Answer

We discontinued SCOM a few months ago, it was impossible to configure and manage it as a one man NOC.

orioncrack · Answer

SCOM does certificate monitoring beautifully. It automatically discovers all certs and allows overrides as needed. Which is why we use SCOM along with SolarWinds as a critical gap filler.

If you have lots of certs to monitor (over 100) then SAM is just not a great option when you have to write separate HTTPS component monitors for each cert - nightmare management.