Quick inventory of all certificates expiring in the next XX days

A simple command line using Certutil to dump out all issued certificates on the server about to expire in the next 60 days:

certutil -view -restrict "NotAfter>now,NotAfter<=now+60,Disposition=20" -out RequestID,RequesterName,Request.CommonName,


...creative uses: Schedule a monthly task in the Windows Task Scheduler with two Components; the first to generate the list and pipe it to a file and the second to mail the text file generated by the 1st part to a DL with your admins in it.

Bonus Points: Do it in Powershell using Regular Expressions, string replacement and Format-Table to get a sleek ouput 🙂

Comments (1)
  1. Kevin Connolly says:

    Thanks, I have an immediate use for that.

    For extra bonus points double check when your web server SSL certificate is due to expire:

     curl -vIs https://www.example.com 2>&1 >/dev/null |  grep "expire date"

Comments are closed.

Skip to main content