Find expiring machine certificates
Documentation: Microsoft Learn
Find local-machine certificates with an expiry before a 30-day cutoff. Report subject, thumbprint, expiry, and private-key availability.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-ChildItem Cert:\LocalMachine\My | Where-Object NotAfter -lt (Get-Date).AddDays(30) | Select-Object Subject,Thumbprint,NotAfter,HasPrivateKey- Stage 1Get-ChildItem
Positional values or no named parameters - Stage 2Where-Object
-lt - Stage 3Select-Object
Positional values or no named parameters
How it works
The certificate provider is browsed at the LocalMachine personal store, Where-Object keeps entries whose NotAfter falls before a date thirty days out, and the projection reports subject, thumbprint, expiry, and whether a private key is present.
Adapting it
Search the WebHosting store as well when IIS is in the picture, since certificates bound to sites are frequently kept there rather than in the personal store.
Requirements
Elevation to read the local machine certificate store.
If the result is unexpected
A certificate-expiry report includes certificates unrelated to the service.
The machine store can contain many certificates, and NotAfter alone does not identify the active binding.
- Inspect the selected store and compare the certificate thumbprint with the service binding.
Validate the result
The certificate being assessed is the one used by the intended service.
Keep the check reliable
Record store, thumbprint and bound service alongside the expiry date.
