139 lines
4.5 KiB
PowerShell
139 lines
4.5 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Check all installed certificates on the system and thier expiration dates.
|
|
|
|
.DESCRIPTION
|
|
This script will Check all installed certificates on the system and thier expiration dates,
|
|
This script should be deployed as a Check Script.
|
|
|
|
.OUTPUTS
|
|
Errorcodes:
|
|
0 - All OK
|
|
1 - There is a certificate that needs attention, with the error message
|
|
2 - There is a certificate about to expire with x amount (specify the days)
|
|
|
|
.EXAMPLE
|
|
Check_scripts/Win - Certificate expiration.ps1
|
|
|
|
# the following is used to return an warning 90 days before a certificate is about to expire
|
|
Check_scripts/Win - Certificate expiration.ps1 90
|
|
|
|
.NOTES
|
|
Author: D.de Kooker <info@dcomputers.nl>
|
|
Source: n/a
|
|
|
|
.CHANGELOG
|
|
17-09-2023 - Initial script.
|
|
#>
|
|
param (
|
|
[int]$WarningDays = 31
|
|
)
|
|
|
|
# Function to check certificates and return the status message
|
|
function Get-CertificateStatus($certificate) {
|
|
$subject = $certificate.Subject
|
|
$expirationDate = $certificate.NotAfter
|
|
|
|
$currentDate = Get-Date
|
|
$thresholdDate = $currentDate.AddDays($WarningDays)
|
|
|
|
if ($expirationDate -lt $currentDate) {
|
|
return "Certificate for $subject has already expired on $expirationDate"
|
|
} elseif ($expirationDate -lt $thresholdDate) {
|
|
return "Certificate for $subject is expiring on $expirationDate (Less than $WarningDays days remaining)"
|
|
} else {
|
|
return "All certificates are valid"
|
|
}
|
|
}
|
|
|
|
# Check all machine certificates from the 'My' certificate store (LocalMachine\My)
|
|
$machineCertificates = Get-ChildItem -Path Cert:\LocalMachine\My
|
|
|
|
# Check all user certificates from the 'My' certificate store (CurrentUser\My)
|
|
$userCertificates = Get-ChildItem -Path Cert:\CurrentUser\My
|
|
|
|
# Check if the 'LocalMachine\WebHosting' certificate store exists
|
|
if (Test-Path Cert:\LocalMachine\WebHosting) {
|
|
# Check certificates from 'LocalMachine\WebHosting'
|
|
$webHostingCertificates = Get-ChildItem -Path Cert:\LocalMachine\WebHosting
|
|
} else {
|
|
$webHostingCertificates = @()
|
|
}
|
|
|
|
# Initialize a flag to track whether all certificates are valid
|
|
$allCertificatesValid = $true
|
|
|
|
# Initialize a flag to track whether expired certificates are found
|
|
$expiredCertificatesFound = $false
|
|
|
|
# Initialize a flag to track whether certificates are about to expire
|
|
$certificatesAboutToExpireFound = $false
|
|
|
|
# Collect certificate status messages in an array
|
|
$certificateStatusMessages = @()
|
|
|
|
# Check machine certificates
|
|
foreach ($cert in $machineCertificates) {
|
|
$status = Get-CertificateStatus $cert
|
|
if ($status -ne "All certificates are valid") {
|
|
$certificateStatusMessages += $status
|
|
$allCertificatesValid = $false
|
|
if ($status -like "*expired*") {
|
|
$expiredCertificatesFound = $true
|
|
} elseif ($status -like "*expiring*") {
|
|
$certificatesAboutToExpireFound = $true
|
|
}
|
|
}
|
|
}
|
|
|
|
# Check user certificates
|
|
foreach ($cert in $userCertificates) {
|
|
$status = Get-CertificateStatus $cert
|
|
if ($status -ne "All certificates are valid") {
|
|
$certificateStatusMessages += $status
|
|
$allCertificatesValid = $false
|
|
if ($status -like "*expired*") {
|
|
$expiredCertificatesFound = $true
|
|
} elseif ($status -like "*expiring*") {
|
|
$certificatesAboutToExpireFound = $true
|
|
}
|
|
}
|
|
}
|
|
|
|
# Check web hosting certificates if the store exists
|
|
if ($webHostingCertificates.Count -gt 0) {
|
|
foreach ($cert in $webHostingCertificates) {
|
|
$status = Get-CertificateStatus $cert
|
|
if ($status -ne "All certificates are valid") {
|
|
$certificateStatusMessages += $status
|
|
$allCertificatesValid = $false
|
|
if ($status -like "*expired*") {
|
|
$expiredCertificatesFound = $true
|
|
} elseif ($status -like "*expiring*") {
|
|
$certificatesAboutToExpireFound = $true
|
|
}
|
|
}
|
|
}
|
|
} else {
|
|
$certificateStatusMessages += "The 'LocalMachine\WebHosting' certificate store does not exist or is empty."
|
|
}
|
|
|
|
# Display certificate status messages
|
|
$certificateStatusMessages | ForEach-Object { Write-Host $_ }
|
|
|
|
# Display "All certificates are valid" and exit with status code 0 if the flag is still true
|
|
if ($allCertificatesValid) {
|
|
Write-Host "All certificates are valid"
|
|
exit 0
|
|
}
|
|
|
|
# Exit with status code 1 if expired certificates are found
|
|
if ($expiredCertificatesFound) {
|
|
exit 1
|
|
}
|
|
|
|
# Exit with status code 2 if certificates are about to expire
|
|
if ($certificatesAboutToExpireFound) {
|
|
exit 2
|
|
}
|