I want to start with a little disclaimer: The real credits for this tool does not really belong to me. This tool is using the really wonderful PSPKI PowerShell module from http://pspki.codeplex.com/ and all credits should go them for making this wonderful piece of work public. I just format the output that those cmd-lets provide into a HTML based report.
A very common problem people have with certificates is that they realize that it’s time to renew their certificates… after they have expired! 
To be able to get a web based report of the certificates in an ADCS CA that is about to expire within 30 days, I wrote this small script today on the train on my way to work. It accepts two switches, –computername of the CA (which defaults to local computer if not specified) and –reportfile (defaults to a HTML-file on the current users desktop).
The script can be run locally on the CA if desired.
This opens up the report.
The report contains all certificates that are expiring within 30 days. This can be edited in the script.
I want to thank a small group of people for their input during the day.
Ludwig “Ludde” Nilsson = for cosmetic input regarding the HTML report.
Stefan Schörling = for his support, thoughts and feedback during the development of this script.
Kerim Sidia = for validation of “intelligent” design.
Niklas Goude = for his clever idea regarding detection of the PSPKI module.
Hasain Alshakarti = for a good note about that the filtering is client based (very large ADCS databases will take longer time to process).
Please note that this is a simple proof of concept and is not done or complete in any way. I will continue to work on this and include many more switches, etc.… but I wanted to show you guys already now what can be done if people share their knowledge and work together.
The code to the script is embedded below.
PKI and ADCS is fun, so go out and play!
// Fredrik “DXter” Jonsson
#ADCS Certificate Expiration Report Tool
#Made by Fredrik “DXter” Jonsson (dxter@poweradmin.se) 2011-08-09
#http://www.poweradmin.se
#Get input strings
param(
[string] $computername = “$ENV:COMPUTERNAME”,
[string] $reportfile = “$ENV:USERPROFILE\Desktop\acert_certificate_expiration_report.html”
)
#Start stopwatch
$totalTime = New-Object -TypeName System.Diagnostics.Stopwatch
$totalTime.Start()
#Credits
Write-Host
Write-Host “ADCS Certificate Expiration Report Tool ” -ForegroundColor “Yellow”
Write-Host “by Fredrik “”DXter”" Jonsson (dxter@poweradmin.se)” -ForegroundColor “Yellow”
Write-Host
if(Get-Module -ListAvailable -Name PKI | Where-Object { $_.name -eq “PKI” })
{
#Import PSPKI PowerShell module
if(Get-Module -Name PKI | Where-Object { $_.name -eq “PKI” })
{
Write-Host “PSPKI PowerShell module already imported…” -ForegroundColor “Yellow”
}
else
{
Write-Host “Importing PSPKI PowerShell module…” -ForegroundColor “Yellow”
Import-Module -Name PKI
}
Write-Host
#Set variables
Write-Host “Setting variables…” -ForegroundColor “Yellow”
Write-Host
$caname = $computername.ToLower()
$domaindns = $ENV:USERDNSDOMAIN.ToLower()
$todaysdate = Get-Date
$findaldate = $todaysdate.AddMonths(1)
$htmlpre = “<P>Generated by user: $ENV:USERNAME</P><P>The following certificates expire before $findaldate</P>”
$htmlpost = “<P>Certificate expiration information retrived from $caname.$domaindns</P>”
$htmltitle = “Certificate expiration information from $caname.$domaindns”
$htmlinput = Get-CertificationAuthority “$caname.$domaindns” | Get-IssuedRequest -Filter “NotAfter -ge $(Get-Date)”, “NotAfter -le $((Get-Date).AddMonths(1))”
#Generate report
Write-Host “Generating report…” -ForegroundColor “Yellow”
Write-Host
$htmlinput | ConvertTo-Html -Body (Get-Date) “Report date:” -Property RequestID,RequesterName,CommonName,NotBefore,NotAfter,SerialNumber -Pre $htmlpre -Post $htmlpost -Title $htmltitle | Out-File -FilePath $reportfile
#Open report
Write-Host “Opening report…” -ForegroundColor “Yellow”
Write-Host
Invoke-Item $reportfile
#Warning if PSPKI is not installed
}
else
{
Write-Host “PSPKI is not installed. Please install it from http://pspki.codeplex.com/ ” -ForegroundColor “Yellow”
Write-Host
}
#Stop stopwatch
$totalTime.Stop()
$ts = $totalTime.Elapsed
$totalTime = [system.String]::Format(“{0:00}:{1:00}:{2:00}”,$ts.Hours, $ts.Minutes, $ts.Seconds)
Write-Host “Process total time: $totalTime” -ForegroundColor Yellow
Write-Host
