如何使用 Powershell 查找僅 IIS 的 SSL 證書何時過期以獲取來自 OU 的服務器列表？

Question

我有這部分代碼，如果我只能讓腳本只回復存在的主題（指示 IIS 證書），那么我可以完成......（我有 OU 枚舉和調用部分向下，以及用於安排任務的文件的電子郵件）：[注意：我將到期時間設置為 500 天，因此我可以稍后使用腳本來查找特定的到期時間] [注意 2：$day 在我的 $profile 中設置to '$day = Get-Date -Format yyyyMMdd']

    $serverlist = $serverListpath.Name
    foreach($server in $serverlist){
        if($server -like '#*')
        {
            continue
        }
    
    $threshold = 500   #Number of days to look for expiring certificates
    $deadline = (Get-Date).AddDays($threshold)   #Set deadline date
    $p = ($c++/$server.count) * 100
     Write-Progress -Activity "Checking $._" -Status "$p % completed" -PercentComplete $p;
     if(Test-Connection -ComputerName $server -Count 2 -Quiet){
     #$server = "KnownIISServerHostname" #<-- to test with a hostname
    Invoke-Command -Verbose -ComputerName $server { Dir Cert:\LocalMachine\My } |`
foreach {
    If ($_.NotAfter -le $deadline) { 
$_ | Select *| select PSComputerName, Subject, NotAfter, @{Label="Expires In (Days)";Expression={($_.NotAfter - (Get-Date)).Days}} }
    }|`
select PSComputerName,Subject, NotAfter, @{Label="Expires In (Days)";Expression={($_.NotAfter - (Get-Date)).Days}} |`
    export-csv -Force -Append -Encoding ASCII -NoTypeInformation .\output\$day-ExpiringIISSSLCerts.csv
    }
    }

那么我在哪里調整它以獲得對只有現有“主題”字段的回復； 不獲取空主題字段回復（即 RDP 證書）

Answer 1

嘗試使用這個：

Import-Module WebAdministration
$CertAll=Get-ChildItem -Path Cert:\LocalMachine\My
$CertInUse=Get-Childitem -Path IIS:\SslBindings
$CertSame=Compare-Object -ReferenceObject $CertAll -DifferenceObject $CertInUse -Property ThumbPrint -IncludeEqual -ExcludeDifferent
$CertSame | foreach{Get-Childitem –path Cert:\LocalMachine\My\$($_.thumbprint)} | Select-Object -Property Subject, @{n=’ExpireInDays’;e={($_.notafter – (Get-Date)).Days}}

Answer 2

由於 IIS 證書是您關注的范圍，因此我建議您使用 IIS PowerShell 模塊來確保您只選擇 IIS 實際使用的證書。

以下內容應使用 HTTPS(SSL) 提取附加到站點的證書。 我目前在單個 IIS 服務器上沒有多個站點進行測試，但理論上這應該找到所有站點，而不僅僅是“默認網站”。

$serverlist = $serverListpath.Name
foreach($server in $serverlist){
    if($server -like '#*')
    {
        continue
    }

$threshold = 500   #Number of days to look for expiring certificates
$deadline = (Get-Date).AddDays($threshold)   #Set deadline date
$p = ($c++/$server.count) * 100
 Write-Progress -Activity "Checking $._" -Status "$p % completed" -PercentComplete $p;
 if(Test-Connection -ComputerName $server -Count 2 -Quiet){
 #$server = "KnownIISServerHostname" #<-- to test with a hostname
 #Pull certificates from existing IIS bindings
 $certificates = Invoke-Command -Verbose -ComputerName $server { 
    Import-Module IISAdministration
    $sitebindings = Get-IISSite | foreach { Get-IISSiteBinding -Protocol HTTPS -Name $_ }
    $thumbprints = $sitebindings.Attributes | where {$_.Name -match "certificateHash"} | Select-Object -ExpandProperty Value
    $thumbprints | foreach {dir Cert:\LocalMachine\My\$_}
    }
$certificates |`
foreach {
    If ($_.NotAfter -le $deadline) { 
    $_ | Select *| select PSComputerName, Subject, NotAfter, @{Label="Expires In (Days)";Expression={($_.NotAfter - (Get-Date)).Days}} }
}|`
select PSComputerName,Subject, NotAfter, @{Label="Expires In (Days)";Expression={($_.NotAfter - (Get-Date)).Days}} |`
export-csv -Force -Append -Encoding ASCII -NoTypeInformation .\output\$day-ExpiringIISSSLCerts.csv
}
}

Answer 3

#完整的本地運行腳本。 在 Foreach 調用命令中調用它。

$CertAll=GCI -Path Cert:\LocalMachine\My
$CertInUse= (GCI IIS:SSLBindings)
$CertSame=Compare-Object -ReferenceObject $CertAll -DifferenceObject $CertInUse -Property ThumbPrint -IncludeEqual -ExcludeDifferent
#$CertSame=Compare-Object -ReferenceObject $CertAll -Property ThumbPrint -IncludeEqual -ExcludeDifferent
$CertSame | foreach{GCI -filter "" –path Cert:\LocalMachine\My\$($_.thumbprint)} | Select-Object -Property Issuer, @{n=’ExpireInDays’;e={($_.notafter – (Get-Date)).Days}} -First 1

---

謝謝@bruce-zhang

Answer 4

類似於@bruce-zhangs 的出色答案，但首先獲取正在使用的證書，然后僅從適當的證書存儲中檢索那些（而不是只查看My證書存儲）：

Import-Module WebAdministration
$CertsInUse = Get-Childitem -Path IIS:\SslBindings
$CertsInUse | foreach{Get-Childitem –path Cert:\LocalMachine\$($_.Store)\$($_.Thumbprint)} | Select-Object -Property FriendlyName,Subject, @{n=’ExpireInDays’;e={($_.notafter – (Get-Date)).Days}}

這是一個更詳細的foreach ：

Import-Module WebAdministration
$CertsInUse = Get-Childitem -Path IIS:\SslBindings
$CertsDetails = @()
foreach ($Cert in $CertsInUse) {
    $CertsDetails += Get-ChildItem -Path Cert:\LocalMachine\$($Cert.Store)\$($Cert.Thumbprint)
}
$CertsDetails | Select-Object -Property FriendlyName,Subject, @{n=’ExpireInDays’;e={($_.notafter – (Get-Date)).Days}}

Answer 5

#checkCertExpDate-manual.ps1
$day = Get-Date -Format yyyyMMdd
$threshold = 5000   #Number of days to look for expiring certificates
$deadline = (Get-Date).AddDays($threshold)   #Set deadline date
Dir Cert:\LocalMachine\My | foreach {
If ($_.NotAfter -le $deadline) { $_ | Select Issuer, Subject, NotAfter, @{Label="Expires In (Days)";Expression={($_.NotAfter - (Get-Date)).Days}} }
}

然后你只需 grep 的名稱：

.\checkCertExpDate-manual.ps1|Select-String -pattern "companyname"

現在，我可以將“$threshold”設置為任何我想要的...

在我復制到每台服務器后，我遠程調用它，並將輸出寫入日志，然后每周從計划任務中自動通過電子郵件發送給自己。

Answer 6

#D:\batch\checkCertExpDate.ps1
    $day = Get-Date -Format yyyyMMdd
    Set-Location d:\batch
    $serverlist = gc ".\serverlist.txt"
    foreach($server in $serverlist)
    {
    $threshold = 45   #Number of days to look for expiring certificates
    $deadline = (Get-Date).AddDays($threshold)   #Set deadline date
    Invoke-Command $server { Dir Cert:\LocalMachine\My } | foreach {
    If ($_.NotAfter -le $deadline) { $_ | Select Issuer, Subject, NotAfter, @{Label="Expires In (Days)";Expression={($_.NotAfter - (Get-Date)).Days}} }
    }|select -expandproperty Subject|out-file .\output\$day-ExpiringIISSSLCerts.txt -Encoding ascii -Append
    }
# Start mail send
$log = "d:\batch\output\$day-ExpiringIISSSLCerts.txt"
    if(Test-Path -Path $log){

$smtpServer = "smtp.domain.com"
$messageSubject = "Verify SSL Cert Check Report - " + $env:computername 
$message = New-Object System.Net.Mail.MailMessage
$message.From = "authorizedaccount@domain.com"
$message.To.Add("patrick.burwell@domain.com")
$message.Subject = $messageSubject 
$message.IsBodyHTML = $true 
$message.Body = "<head><pre>$style</pre></head>" 
$message.Body += "Cert Check Report - " + $env:computername
$message.Body += Get-Date
$message.Body += "<br><b>Expiring Non-Prod Verify SSL Certificates Report from " + $env:computername + "</b>"
$message.Attachments.Add($log)
$smtp = New-Object Net.Mail.SmtpClient($smtpServer) 
$smtp.Send($message)
}
$result = Get-content $log
write-host $result |format-list -View table