Display SSL certificate expiration dates via PowerShell

Question

Display SSL certificate expiration dates via PowerShell

Jess13777 41

Hello! I'm trying to figure out how to display when SSL certificates expire. Currently, I have the following code (which was provided to me by a colleague) and I want to know how to display the certificate's expiration date. If possible I would also like to know if there is a way to display certificates that expire in a certain time frame (i.e. show SSL certificates expiring between June 1st to July 1st, or sho certificates that only expire on June 25th). Thank you so much for your help in advance!

# Get a list of certs  
dir Cert:\LocalMachine\My  
  
# Grab the thumbprint for the cert we want to use  
$certHash = "D3A6E7B1746DFA37D4B93263AAA1348A2BA41720"  
  
# Get the AppID for the existing app on the interface  
netsh http show sslcert  
$guid = "5d8e2743-ef20-4d38-8751-7e400f200e65"  
  
$ip = "0.0.0.0" # This means all IP addresses  
$port = "443" # the default HTTPS port  
#"http update sslcert ipport=$($ip):$port certhash=$certHash appid={$guid}" | netsh

Bruce Zhang-MSFT 3,771 Reputation points

2022-06-17T07:10:03.797+00:00

Hi @Jess13777 ,

There's a property about certificate called NotAfter. You can get expire date from NotAfter and start date from NotBefore. So as @Rich Matheisen provided, his powershell script can get expire date. You can try it.

Accepted answer

2 additional answers

Your answer

Bruce Zhang-MSFT 3,771 Reputation points

2022-06-17T07:10:03.797+00:00

Hi @Jess13777 ,

There's a property about certificate called NotAfter. You can get expire date from NotAfter and start date from NotBefore. So as @Rich Matheisen provided, his powershell script can get expire date. You can try it.

Answer 1

Rich Matheisen 47,901

You can use this as a starting point for checking the explicit dates, or range of cert expiration dates, in a script:

$certHash = "D3A6E7B1746DFA37D4B93263AAA1348A2BA41720"  
Get-ChildItem -Path cert:\LocalMachine\My -Recurse |   
    Where-Object {$_.Thumbprint -eq $cert} |  
        Select-Object NotAfter

Venkadesh 1 Reputation point

2022-08-08T12:07:37.517+00:00

Hi Ritchie,

Note:My requirement is i want to get only expiration certificate details using powershell command.kinldy help us ASAP.

$certHash what does meant?

I gave this command below then i am not getting any output.

Get-ChildItem -Path cert:\LocalMachine\My -Recurse |
Where-Object {$_.Thumbprint -eq $cert} |
Select-Object NotAfter
Rich Matheisen 47,901 Reputation points

2022-08-08T18:03:49.203+00:00

In your original question, you said "how to display when SSL certificates expire". You provided some sample code and, in that code you showed the thumbprint of a single certificate.

A thumbprint is a calculated value that uniquely identifies a single certificate and is usually referred to as a "hash value".

The code sample I provided used the thumbprint value you provided and placed it into a variable named $certHash (for "Certificate Hash). I didn't want to use a variable named "$thumbprint" because it might be confused with the certificate property named "Thumbprint".

If my code finds the certificate with the thumbprint you provided it then displays the certificate's expiration date. The code doesn't compare the expiry date against anything because you didn't specify if you wanted to look only for already expired certificates or for certificates that will expire in the next "X" days.

DC-3711 1

@Venkadesh It works if you change the variable from $cert to $certHash, see my edit to the original below:

$certHash = "D3A6E7B1746DFA37D4B93263AAA1348A2BA41720"  
Get-ChildItem -Path cert:\LocalMachine\My -Recurse |   
  Where-Object {$_.Thumbprint -eq $certHash} |  
    Select-Object NotAfter

Answer 2

Hi there,

To find certificates that will expire in the next 30 days on all domain servers, use this PowerShell script:

$servers= (Get-ADComputer -LDAPFilter "(&(objectCategory=computer)(operatingSystem=Windows Server*) (!serviceprincipalname=MSClusterVirtualServer) (!(userAccountControl:1.2.840.113556.1.4.803:=2)))").Name
$result=@()
foreach ($server in $servers)
{
$ErrorActionPreference="SilentlyContinue"
$getcert=Invoke-Command -ComputerName $server { Get-ChildItem -Path Cert:\LocalMachine\My -Recurse -ExpiringInDays 30}
foreach ($cert in $getcert) {
$result+=New-Object -TypeName PSObject -Property ([ordered]@{
'Server'=$server;
'Certificate'=$cert.Issuer;
'Expires'=$cert.NotAfter
})
}
}
Write-Output $result

------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–

Venkadesh 1 Reputation point

2022-08-08T12:13:11.173+00:00

Hi,

how do i get only expiration certification details in local server using powershell script.i want to get certificate details on or before 08-Aug-2022

for ex.today date is 08-Aug-2022.
Next scanerios: I want to send e mail notification from each server via smtp.

Answer 3

S S 0

I tried this script, and it shows all certificates that are tied to IIS websites.

https://www.azurehowtos.com/2025/02/Solved-%20How%20to%20Find%20certificates%20in%20IIS%20that%20are%20expiring%20within%20the%20next%2030%20days.html

Share via

Display SSL certificate expiration dates via PowerShell

2 additional answers

Your answer