A lot of organizations have multiple websites and multiple subdomains with an SSL Certificate assigned. Tracking the expiry date for these certificates can be a bit of a challenge. PowerShell can help in reading the certificate details and reporting them to the sysadmin.

In this post, I created a PowerShell script to scan a site list, retrieve the certificate information, and export it to CSV or email.

Downloading PowerShell Certificate Scanner Script

If you are in a rush, feel free and get the script from my Github repo over here or get by running the following code to get it from the PowerShell Gallery

Install-Script -Name CertificateScanner

Prerequisites

  • PowerShell 7 or Windows PowerShell
  • Recommend being a local admin on the PC

6 March 2023: Fix SaveAsTo
28 Feb 2024: Version 2

What is PowerShell Certificate Scanner

This PowerShell script scans multiple sites and retrieves the SSL certificate information, mainly:

  • URL
  • Subject CN
  • Issuer
  • Issued Date
  • Expire Date
  • Protocol

The SSL certificate can be on a remote domain or internal domain.

PS7 > .\CertificateScanner.ps1 -FilePath C:\Users\sitelist.txt
or
PS7 > .\CertificateScanner.ps1 -SiteToScan "https://www.mysite.com:8443/"

Now you can scan a website with a custom port 

The Full result are as the following

URL       : www.cnn.com
StartDate : 20-Apr-21 11:10:07 PM
EndDate   : 22-May-22 11:10:06 PM
Issuer    : CN=GlobalSign Atlas R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE
Subject   : CN=*.api.cnn.com
Protocol  : Default

URL       : 192.168.10.10
StartDate : 07-Mar-16 12:27:35 PM
EndDate   : 02-Mar-26 12:27:34 PM
Issuer    : O=VMESXI.server.com, C=US, DC=local, DC=vsphere, CN=CA
Subject   : C=US, CN=VMESXI.server.com
Protocol  : TLS12

URL       : www.google.com
StartDate : 29-Nov-21 7:36:34 AM
EndDate   : 21-Feb-22 7:36:33 AM
Issuer    : CN=GTS CA 1C3, O=Google Trust Services LLC, C=US
Subject   : CN=www.google.com
Protocol  : Default

Also, and as an option, the script supports running the scan using one of the following protocols: SSLv3, TLS1, TLS1.1, and TLS1.2. This helps to scan sites that are running an old webserver that doesn’t support the latest secure protocols.

The script generates the result and can display it in the console, save it as a CSV ,or send the result by email.

Using the PowerShell certificate scanner

The PowerShell Certificate Scanner require some parameters as shown below

  • [Mandatory, String]LoadFromFile: Path for a txt file that include the domains
  • [Mandatory, String]SiteToScan: the site name you want to scan
  • [Optional, ValidationSet]ProtocolVersion: Select the protocol to connect this include TLS, TLS1.1, TLS1.2 and SSLv3
  • [Optional, String]SaveAsTo: Location to save the result to (CSV).
  • [Optional, String]EmailSendTo: Send a copy of the report.
  • [Optional, String]EmailFrom: The Email Sender
  • [Optional, String]EmailSMTPServer: SMTP Server to use for mail relay.
  • [Optional, String]EmailSMTPServerPort SMTP Server Port, usually its 25
  • [Optional, Switch]EmailSMTPServerSSL: Use SSL for communication
  • [Optional, String]EmailSubject: The Message Subject to use.

The LoadFromFile should contain a site list one on each line, the format should be only the site without the https. The script can sanitize the list and clean the list, so if your domain list include the protocol, its OK. Also you can include sites with a custome secure port for example www.google.com:8443.

You cannot use both LoadFromFile and SiteToScan together, only one

NOTE

Showing Results on the screen

Running the script without SaveAsTo shows the result on the screen only. The script can return the result to a variable. For example

$MySite=.\CertificateScanner.ps1 -SiteToScan "https://www.google.com"

Saving the results to a file

You can use the PowerShell certificate scanner to save the result to a file .csv by using the -SaveAsTo 

.\CertificateScanner.ps1 -LoadFromFile C:\Users\test.txt -SaveAsTo C:\MyResult.csv

The result shows the certificate expiration dates, issuing date, Subject CN, and the issuer, plus the protocol used to run the scan

Saved results
Saved results

Selecting the protocol

You can select the protocol to use during the connection. The available protocols are TLS, TLS1.1, TLS1.2, and SSLv3.

In the example below, the script uses SSLv3 to connect and get the certificate information.

.\CertificateScanner.ps1 -LoadFromFile C:\Users\test.txt -SaveAsTo C:\MyResult.csv -ProtocolVersion Tls

PowerShell 7 Doesnt Support SSLv3

If the site doesn’t support the protocol, the script returns an error.

The Full result are as the following

URL       : www.cnn.com
StartDate : 20-Apr-21 11:10:07 PM
EndDate   : 22-May-22 11:10:06 PM
Issuer    : CN=GlobalSign Atlas R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE
Subject   : CN=*.api.cnn.com
Protocol  : Tls

URL       : www.powershellcenter.com
StartDate : Exception calling "AuthenticateAsClient" with "4" argument(s): "Authentication failed, see inner
            exception."
EndDate   : Maybe Unsupported protocol..
Issuer    :
Subject   :
Protocol  :

As shown in the picture, www.powershellcenter.com doesn’t support TLS1.0.

The protocol scan may be effected by some security devices alone the network route, such as WAF and other security firewall.

Sending Result By email

To receive the result by email, multiple parameters should be provided, In the following example, the script sents the result using a local SMTP server:

.\CertificateScanner.ps1 -LoadFromFile C:\Users\Domainlist.txt -ProtocolVersion Tls -EmailSendTo Recp@domain.com -EmailFrom Sender@domain.com -EmailSMTPServer smtpserver.domain.com -EmailSMTPServerSSL $False -EmailSubject "Scanning Results"

The script requests to authenticate with the mail server, you need to provide a username and password to authenticate, or feel free and remove the authentication part from the script.

To send email using Office365, please refer to How to Send Email with Office 365 Direct Send and PowerShell

Conclusion

This script should help sysadmin in finding the assigned SSL certificate on a website list and provide them with the expiration date, which helps them in replacing these certificates before it gets expired.

Let me know in the comment what do you think about it and how to improve it, surely there is still a lot to do, but for now. hope this helps.

5/5 - (1 vote)