Monitoring SSL Certs with name of Certs as well as Expiration Date

Hello All,

I know there are a lot of discussions on Monitoring SSL Certs Expiration Dates but I have noticed that it will only show you when it expires but it doesn't show the names of them. Can someone write a script that will show all the Certs on a server with the expiration date of them even if the expiration date isn't near expiration? I tried the Out of the Box SSL Certificate Expiration Date Monitor and it only shows that a Cert will expire in XX amount of days it doesn't give the actual name of the Cert.

I know that in Appinsight for IIS shows the Certs but I would rather have this as its own App Monitor

Cert Expire.jpg

Find more posts tagged with

Accepted answers

All comments

orioncrack

This script could be modified to do this if anyone has some time. This script emails results but can be modified for a template most likely. Quest ActiveRoles snapin can be grabbed from the demo QAR ISO.

#================================================

param(
[string]$OutputType
)
cls
#### CONFIG BEGIN ####
#Import Required Addins
if ( (Get-PSSnapin -Name quest.activeroles.admanagement -ErrorAction SilentlyContinue) -eq $null )
{
Add-PsSnapin quest.activeroles.admanagement
}

$invocation = (Get-Variable MyInvocation).Value
$CurrentDirectoryPath = Split-Path $invocation.MyCommand.Path
$ExportCSVfile = "$CurrentDirectoryPath\ExpiringCertsReport.csv"
$ExportHTMLfile = "$CurrentDirectoryPath\ExpiringCertsReport.html"
$ADQuerySizeLimit = 0
$CertDaysUntilExpired = 90 #Amount of days until experation to look for
#### CONFIG END ####

#### SMTP CONFIG START ####
#SMTP Server Name
$EmailTitle = "Expiring Certs Alert"
$smtpServer = "email.MyCo.com"
#Creating a Mail object
$msg = New-Object Net.Mail.MailMessage
#Creating SMTP server object
$smtp = New-Object Net.Mail.SmtpClient($smtpServer)
#Email Structure
$msg.From = "ExpiringCertsAlerts@MyCo.com"
$msg.ReplyTo = "ExpiringCertsAlerts@MyCo.com"
#$msg.To.Add("ServerSupport@MyCo.com")
$msg.To.Add("email@MyCo.com")
$msg.IsBodyHTML = $true
$msg.Subject = "$EmailTitle"
#### SMTP CONFIG END ####

#### HTML Formatting Start ####
$htmlheader = "<style>"
$htmlheader = $htmlheader + "BODY{background-color:peachpuff;}"
$htmlheader = $htmlheader + "TABLE{width:85%;border-width: 1px;border-style: solid;border-color: black;border-collapse: collapse;}"
$htmlheader = $htmlheader + "TH{border-width: 1px;padding: 3px;border-style: solid;border-color: black;text-align:center;background-color:thistle}"
$htmlheader = $htmlheader + "TD{border-width: 1px;padding: 3px;border-style: solid;border-color: black;text-align:center;background-color:palegoldenrod}"
$htmlheader = $htmlheader + "</style>"

$htmlbody = "<H2>$EmailTitle</H2>"
$htmlbody += "<H4>The following Servers have Certificates that are going to expire in $CertDaysUntilExpired days.</H4>"

#### HTML Formatting End ####

Function Get-Certificate {

<#
.SYNOPSIS
Retrieves certificates from a local or remote system.

.DESCRIPTION
Retrieves certificates from a local or remote system.

.PARAMETER Computername
A single or list of computernames to perform search against

.PARAMETER StoreName
The name of the certificate store name that you want to search

.PARAMETER StoreLocation
The location of the certificate store.

.NOTES

Name: Get-Certificate

Version History:

1.0 - Initial Version

.EXAMPLE
Get-Certificate -Computername 'boe-pc' -StoreName My -StoreLocation LocalMachine

Thumbprint                                 Subject
----------                                 -------
F29B6CB248E3395B2EB45FCA6EA15005F64F2B4E   CN=SomeCert
B93BA840652FB8273CCB1ABD804B2A035AA39877   CN=YetAnotherCert
B1FF5E183E5C4F03559E80B49C2546BBB14CCB18   CN=BOE
65F5A012F0FE3DF8AC6B5D6E07817F05D2DF5104   CN=SomeOtherCert
63BD74490E182A341405B033DFE6768E00ECF21B   CN=www.example.com

Description
-----------
Lists all certificates

.EXAMPLE
Get-Certificate -Computername 'b-pc' -StoreName My -StoreLocation LocalMachine -DaysUntilExpired 14 | Select Subject, DaysUntilExpired,NotAfter

Subject                              DaysUntilExpired NotAfter
-------                              ---------------- --------
CN=SomeCert                                        12 10/22/2014 12:00:00 AM
CN=SomeOtherCert                                    4 10/14/2014 12:00:00 AM
CN=www.example.com                            Expired 12/21/2011 11:00:00 PM

Description
-----------
Lists all certificates that Expire in 14 days or has already expired

.EXAMPLE
Get-Certificate -Computername 'b-pc' -StoreName My -StoreLocation LocalMachine -DaysUntilExpired 14 -HideExpired | Select Subject, DaysUntilExpired,NotAfter

Subject                              DaysUntilExpired NotAfter
-------                              ---------------- --------
CN=SomeCert                                        12 10/22/2014 12:00:00 AM
CN=SomeOtherCert                                    4 10/14/2014 12:00:00 AM

Description
-----------
Lists all certificates that Expire in 14 days and hides certificates that have expired
#>

[cmdletbinding(
DefaultParameterSetName = 'All'
)]

Param (
[parameter(ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$True)]
[Alias('PSComputername','__Server','IPAddress')]
[string[]]$Computername = $env:COMPUTERNAME,
[System.Security.Cryptography.X509Certificates.StoreName]$StoreName = 'My',
[System.Security.Cryptography.X509Certificates.StoreLocation]$StoreLocation = 'LocalMachine',
[parameter(ParameterSetName='Expire')]
[Int]$DaysUntilExpired,
[parameter(ParameterSetName='Expire')]
[Switch]$HideExpired
)

Process {
ForEach ($Computer in $Computername) {
   Try {
    Write-Verbose ("Connecting to {0}\{1}" -f "\\$($Computername)\$($StoreName)",$StoreLocation)
    $CertStore = New-Object System.Security.Cryptography.X509Certificates.X509Store -ArgumentList "\\$($Computername)\$($StoreName)", $StoreLocation
    $CertStore.Open('ReadOnly')
    Write-Verbose "ParameterSetName: $($PSCmdlet.ParameterSetName)"
    Switch ($PSCmdlet.ParameterSetName) {
     'All' {
       $CertStore.Certificates
      }
     'Expire' {
       $CertStore.Certificates | Where {$_.NotAfter -lt (Get-Date).AddDays($DaysUntilExpired)} | ForEach {
        $Days = Switch ((New-TimeSpan -End $_.NotAfter).Days) {{$_ -gt 0} {$_} Default {'Expired'}}
        $Cert = $_ | Add-Member -MemberType NoteProperty -Name DaysUntilExpired -Value $Days -PassThru
        If ($HideExpired -AND $_.DaysUntilExpired -ne 'Expired') {
         $Cert
        } ElseIf (-Not $HideExpired) {
         $Cert
        }
       }
      }
    }

} Catch {Write-Warning "$($Computer): $_"}
}
}
}

$ServersToExclude = @(';"US*"','"URT*"','"EN*"','"E*"','"K*"','"A*"','"O*"','"*C*"')
$ExcludeFilter = $null
for ($i=0; $i -lt $serversToExclude.length; $i++) {

if($i -ne $($serversToExclude.length -1)) {

        $ExcludeFilter += '$_.Name -notlike ' +$serversToExclude[$i]+" -and "
    }
    else {
       $ExcludeFilter += '$_.Name -notlike ' +$serversToExclude[$i]
    }
}

$ComputerList = Get-QADComputer -OSName 'Windows Server*' -SizeLimit $ADQuerySizeLimit | Where-Object -FilterScript {iex $ExcludeFilter} | Select-Object Name | Sort-Object Name| ForEach-Object {$_.Name}
#$ComputerList = "Server1","Server2","Server3"

$Report = $null
$Report = foreach ($computer in $ComputerList) {$computer=$computer;Get-Certificate -Computername $computer -StoreLocation LocalMachine -StoreName "My" -DaysUntilExpired $CertDaysUntilExpired |Select @{l="Computer";e={$computer}},Subject, DaysUntilExpired,NotAfter}
$Report = $Report | Select Computer,Subject, DaysUntilExpired,NotAfter | Sort-Object DaysUntilExpired

switch ($OutputType)
    {
        GridView {
            $Report | Out-GridView
        }
        CSV {
            $Report | Export-Csv -NoTypeInformation $ExportCSVfile
        }
        HTML {
            $Report | ConvertTo-Html -Head $htmlheader -Body $htmlbody | Out-File $ExportHTMLfile
        }
        EmailReport {
            $ExpiringCertsReport = $Report
            if ($ExpiringCertsReport) {
                $EmailBody = $ExpiringCertsReport | ConvertTo-Html -Head $htmlheader -Body $htmlbody
                $EmailBody += "<br>This report was generated on $env:computername <br><br>"
                $msg.body = $EmailBody
                Write-Host "sending email."
                $smtp.Send($msg)
            }
        }
        default {
            iex $cmd | Out-GridView
        }
    }

delfaver

(Head explodes)

agusst

So the way I setup my SSL monitors was to create external nodes objects of each site / url....then I added them to the a template called "SSL Certificate Expiration Date". I don't remember if this was one I downloaded or if it was one that came with SAM...it's been a long time since I set it all up. It shows me the name of the cert on the application monitor page, if I drill down into the node it tells me the days remaining...but I know if it's yellow, I have 30 days left and if it's red, I have 15.

I also tied the monitor it to a automated report which gives me the name of the certs that are going to expire every month....whenever we add a new site, I build a new external node to monitor and add it to the template, but it's all part of our build process.

Seashore

We are using a powershell component to check ALL certificates on a server (Local computer store only) and get the name of the certificates that expires within x days. Works for us! :-)

[CmdletBinding()]

[OutputType([String])]

Param

(

#Specify thumpprint of certificate to be excluded.

[Parameter(Mandatory=$false)]

[String[]]

$ThumbprintExclude,

[Parameter(Mandatory=$False)]

[int]

#Specify what expiration day to look for in days from now.

$Days = '30'

)

Process

{

$certstore = Get-ChildItem Cert:\LocalMachine\My | Where {$_.NotAfter -lt (Get-Date).AddDays($days) }

IF ($ThumbprintExclude -ne $null){

Foreach ($thumbprint in $ThumbprintExclude){

$certstore = $certstore | where {$_.Thumbprint -ne $thumbprint}

}

$certstore | ForEach-Object {

Write-host "Message: Certificate with subject" $_.Subject "will expire on" $_.NotAfter

}

Write-host "Statistic:" $certstore.Count

}

/Thomas