A reader sent me a message asking how to modify the original CA monitoring script I wrote back in November so that instead of monitoring the pending requests, it would send a message based on expiring certificates. The answer is just a modification to the certutil command that was used in the original script. The new script also allows you to specify the number of days advanced notification you are looking for, the default is 30 days. Just keep in mind that if you run this script once a day, you will receive a notification every day until the certificate is either revoked/superseded or the certificate is passed the time period specified. Of course this is all irrelevant if you have the money to spend on SCOM which can do this with one of the released management packs.
The modified certutil command looks a bit like this:
certutil -view -restrict "NotAfter>=8/9/2010,NotAfter<=9/9/2010" -out "Request ID, Request Submission Date, Request Common Name, Requester Name, Request Email Address, Request Distinguished Name, CertificateTemplate, NotAfter" -config "<CA_SERVER_NAME>\<CA_NAME>"
This will return to you all of the certificates that are scheduled to expire between today (August 9th, 2010) and 30 days from now (September 9th, 2010)
You can download the new script here: Download monitor_ca_expiry.ps1
Update: Thanks to Aaron (from New Mexico? the original reader) who noticed I forgot one really useful bit of information from the status report that displays when you run the command: the date of expiration for the certificate. I have updated the script and the sample above to reflect the change.