SSL certificate warning before expiration

[spork_]

I've seen other monitoring systems provide alerts when an SSL certificate is
going to expire within x number of days. The IIS MP only seems to report on
SSL certifications after they have expired. Am i correct in this assumption?

I'd like to take a more proactive approach to our SSL certificate monitoring
and was wondering if anyone had created a proactive monitor and could provide
some guidance.

[Anders Bengtsson [MVP]]

Hello spork_,

I think you will need a script for this, there is a example at http://msdn.microsoft.com/en-us/library/bb614564(VS.85).aspx

you could run a script based on a schedule that sends information back to
Ops Mgr. Bu start with look for events in the local event viewer about cert
about to expire, then simple create a rule to collect them. Also check in
the base OS MP if there is anything about this.


Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se

Post by spork_
I've seen other monitoring systems provide alerts when an SSL
certificate is going to expire within x number of days. The IIS MP
only seems to report on SSL certifications after they have expired. Am
i correct in this assumption?
I'd like to take a more proactive approach to our SSL certificate
monitoring and was wondering if anyone had created a proactive monitor
and could provide some guidance.

[spork_]

I've found a way via vbscript to access the certificate date, and datediff
from today. Unfortunately the iis 7 no longer uses the wmi object
"IIS.CertObj" so this script only works on IE6. At this point i may look to
do this another way. I included the script below incase others would like to
see it. I

strComputer = "localhost"
SET objService = GetObject( "IIS://" & strComputer & "/W3SVC")

EnumServersites objService

SUB EnumServersites( objSrv )
FOR Each objServer IN objSrv
IF objServer.Class = "IIsWebServer" Then
IF NOT Ubound(objServer.SecureBindings) = "-1" Then 'check to
see if there is at least one securebinding
WScript.Echo "Site ID = " & objServer.Name & VbCrLf & "Comment = """ &
objServer.ServerComment
wscript.Echo "SSL Certificate Expiration Date: " &
GetSSLExpirationDate(objServer.Name)
wscript.Echo "Days Remaining: " &
DaysRemaining(GetSSLExpirationDate(objServer.Name))
wscript.echo vbcrlf & "-----------------------------" & vbcrlf
END IF
END IF
strBindings = ""
Next
END Sub

FUNCTION GetSSLExpirationDate( strSiteID )
Set iiscertobj = WScript.CreateObject("IIS.CertObj")
iiscertobj.serverName = "localhost"
iiscertobj.InstanceName = "W3SVC/" & strSiteID

tmpArray = Split(iiscertobj.GetCertInfo,vbLf)
For Each x in tmpArray
If Left(x,2) = "6=" Then
GetSSLExpirationDate = Mid(x,3,len(x)-2)
End If
Next
END FUNCTION

Function DaysRemaining(strdate)
If IsDate(strDate) Then
strdate = cDate(strdate)
End If
DaysRemaining = DateDiff("d",Date,strdate)
End Function

Post by spork_
I've seen other monitoring systems provide alerts when an SSL certificate is
going to expire within x number of days. The IIS MP only seems to report on
SSL certifications after they have expired. Am i correct in this assumption?
I'd like to take a more proactive approach to our SSL certificate monitoring
and was wondering if anyone had created a proactive monitor and could provide
some guidance.