Display SSL certificate expiration dates via PowerShell

Question

Hello! I'm trying to figure out how to display when SSL certificates expire. Currently, I have the following code (which was provided to me by a colleague) and I want to know how to display the certificate's expiration date. If possible I would also like to know if there is a way to display certificates that expire in a certain time frame (i.e. show SSL certificates expiring between June 1st to July 1st, or sho certificates that only expire on June 25th). Thank you so much for your help in advance!

# Get a list of certs  
dir Cert:\LocalMachine\My  
  
# Grab the thumbprint for the cert we want to use  
$certHash = "D3A6E7B1746DFA37D4B93263AAA1348A2BA41720"  
  
# Get the AppID for the existing app on the interface  
netsh http show sslcert  
$guid = "5d8e2743-ef20-4d38-8751-7e400f200e65"  
  
$ip = "0.0.0.0" # This means all IP addresses  
$port = "443" # the default HTTPS port  
#"http update sslcert ipport=$($ip):$port certhash=$certHash appid={$guid}" | netsh  

Answer 1

You can use this as a starting point for checking the explicit dates, or range of cert expiration dates, in a script:

$certHash = "D3A6E7B1746DFA37D4B93263AAA1348A2BA41720"  
Get-ChildItem -Path cert:\LocalMachine\My -Recurse |   
    Where-Object {$_.Thumbprint -eq $cert} |  
        Select-Object NotAfter  

Answer 2

Hi there,

To find certificates that will expire in the next 30 days on all domain servers, use this PowerShell script:

$servers= (Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(operatingSystem=Windows Server*) (!serviceprincipalname=MSClusterVirtualServer) (!(userAccountControl:1.2.840.113556.1.4.803:=2)))").Name
$result=@()
foreach ($server in $servers)
{
$ErrorActionPreference="SilentlyContinue"
$getcert=Invoke-Command -ComputerName $server { Get-ChildItem -Path Cert:\LocalMachine\My -Recurse -ExpiringInDays 30}
foreach ($cert in $getcert) {
$result+=New-Object -TypeName PSObject -Property ([ordered]@{
'Server'=$server;
'Certificate'=$cert.Issuer;
'Expires'=$cert.NotAfter
})
}
}
Write-Output $result

------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–