certmon.de DE

Download ADCS Health Check

One file, nothing to install. Verify the checksum before you run the script.

Version
0.2.0
Released
Size
95 KB (97,185 bytes)
Signature
not signed yet (signature on its way)
SHA256
12e450aeed46ea92cc4f743b42abfcf0df0c9ed8e8b07b44e507b8ea878c3e3a
Download ADCS-HealthCheck.ps1 Checksum file (.sha256)

Permanent link to this version: ADCS-HealthCheck-0.2.0.ps1

Verify the checksum

The hash must match the SHA256 value above. Only then unblock and run the file:

Get-FileHash .\ADCS-HealthCheck.ps1 -Algorithm SHA256
Unblock-File .\ADCS-HealthCheck.ps1
powershell -ExecutionPolicy Bypass -File .\ADCS-HealthCheck.ps1

System requirements

  • Windows Server or Windows client, member of a domain with an enterprise CA
  • Windows PowerShell 5.1 or PowerShell 7 (on Windows)
  • Domain account; read access to the CA for the CA database (e.g. CA administrator)
  • No modules, no RSAT, no internet access needed

Changelog

0.2.0 – 2026-09-25

Bilingual, and moved to the new website certmon.de.

  • Report and console in English and German. New parameter -Language de|en; without it the language follows the Windows display language (German → German, anything else → English).
  • All texts live in one table per language; no more hard-coded texts in the code.
  • Every finding has a stable Id (e.g. CRL_EXPIRED, CRL_ORPHANED, CA_CERT_EXPIRING). Category and status are language-independent ids as well (CRL, CA_CERTS …; Critical, Warning, Info, OK).
  • JSON output changed: fields are now id, category, status, object, message, recommendation, date (ISO 8601, UTC), plus language, exitCode and summary. If you parse the JSON of 0.1.x, switch to the ids (previously German category and status names).
  • The waitlist link in the report points to https://certmon.de/<de|en>/ (with UTM parameters); product name "ADCS Health Check by certmon.de". Vendor remains 247-IT.
  • English dates in yyyy-MM-dd format, numbers formatted per language (1,284 / 1.284).
  • Minor: correct singular for "expired 1 day ago", findings start with a capital letter, "Freeware, provided as is without any warranty" note in the report.
  • The build copies script, versioned copy, checksum, version.json and sample reports (DE/EN) to the website (website/public/) after the tests pass.
  • README also in English (README.en.md), draft license terms LICENSE.md.

0.1.2 – 2026-09-25

After test runs as domain admin (DC) and as a regular domain user (member server).

  • Several expired CA certificates with the same name are combined into one line listing all expiry dates.
  • Orphaned CRLs: more careful wording when the paths of the issued certificates could not be determined.
  • The "other servers not checked" note also appears when the local certificate store is empty.

0.1.1 – 2026-09-24

Lessons from the first run in a real environment (DC with enterprise CA, CA moved in 2020).

  • Orphaned CRLs after moving a CA are detected and reported as a note instead of critical (location not referenced and a newer version exists elsewhere). One entry per location instead of per base/delta.
  • New note when the issued certificates contain no HTTP CRL path.
  • CRL findings name the certificates that use the location.
  • Local store: expired certificates from other issuers (e.g. Microsoft services) are only counted.
  • Fix: the C# part compiles under Windows PowerShell 5.1 (warning treated as error on a bit operation).
  • Minor: grammar in the chain validation.

0.1.0 – 2026-09-24

First version.

  • Find enterprise CAs in AD, check availability
  • CA certificates: expiry, key length, signature algorithm, chain validation with revocation status
  • CRLs from AD and HTTP: expiry, overdue publishing, stale copies, missing LDAP objects
  • CDP/AIA availability
  • NTAuth store
  • Expiring, not yet renewed certificates from the CA database
  • Local computer store
  • HTML report with traffic light (light/dark, mobile, printable), optional JSON, exit codes for RMM
  • Demo mode for screenshots

Freeware, provided as is without any warranty. Use at your own risk. Questions: mail@247-it.com