Finding expiring certificates in your CA

A while ago, I was working on a method of discovering and creating alerts for expiring smartcards.  While looking at some of the various methods to pull details from FIM certificate manager or the AD certificate services CA that issues the certs, I ended up goinig with certutil as the tool of choice for pulling the data.  The build in filtering of the results helped give the ability to confine the results to certain certificate types, and also to avoid anything that was revoked.  Putting this together with output processing in powershell, it is pretty easy to pull together a list of certs and their expiration time.  Using grouping, you can avoid the problem of having multiple results per user (for those who have already renewed).  Since smartcards use UPN as an identifier, I went with that attribute to help get the user details.  For other use cases that would need to be modifed and the Get-ADUser functionality wouldn't be required.

#this line needs to be modified to target the CA and the OID
#of the cert type that you want to look at (if you are restricting it
#Disposition of 20 means certs that are active
certutil -config "<CA server FQDN>\<CA NAME>" -view -out "user principal name,certificate expiration date" -restrict "certificatetemplate=<templateOID>,Disposition=20"  > .\certdump.txt

$results = @()
$recordbound = $false
Try { $data = get-content .\testcertdump.txt -erroraction stop } catch { 
		#error handling
	}
For ($i=0; $i -lt $data.count; $i++) {
	#process the multiline record to get user UPN account name and certificate expirations
	if ($recordbound) {
		$result = new-object PSobject
		$UPN = $data[$i].substring($data[$i].indexof('"')+1).trim('"')
		$dateval = $data[$i+1].substring($data[$i+1].indexof(":")+1)
		$dateval = [datetime]$dateval
		add-member -input $result NoteProperty UPN $upn
		add-member -input $result NoteProperty Expiration $dateval
		$i = $i+2
		$recordbound = $false
		$results += $result
	}

	#start of a new multiline record
	if ($data[$i] -match "^Row ") {
		$recordbound = $true
	}
}

#User may have renewed before, so there can be more than one cert...so group by user UPN
$groupdata = $results|group UPN
$curdate = get-date

#Look at all certificates for a given user and select the one with the furthest expiration date (I.e. last one issued to this UPN)
$groupdata = $groupdata | Select Name,@{name="expiration";expression={($_.group|sort expiration |select -last 1).expiration}}

foreach ($entry in $groupdata) {
	$debugstr = "$($entry.name)  Expiration $($entry.expiration)"
	$timediff = new-timespan -start $entry.expiration -end $curdate
	$days = 0 - $timediff.days
	if ($days -lt 30) {
		$debugstr += ".  In expiration window."
		#expiration warning, need to find primary account email and send it, if they are still active
		$user = get-aduser -ldapfilter "(&(objectclass=user)(userprincipalname=$($entry.name)))" -properties enabled,manager
		if ($user.enabled) {
			$debugstr += "  Account is enabled."
			#do something with it
		} else {
			$debugstr += " User 431 is disabled, ignoring."
		}
	}
	write-debug $debugstr
}