View Certificates Issued to Hostname in ADCS

Active Directory Certificate Services (ADCS) is a useful service to provide in a Windows Domain environment. If you’re managing ADCS, you might want a quick way to list issued certificates to a specific hostname. Here’s a quick PowerShell script that helps put the right filters on “certutil -view” command to list certs for a given computer name.

# Change the filter and column list as needed to match your query needs.
# Query Active Directory Certificate Services for Certs issued to given hostname
function view_certs($prefix, $config=$null) {
# call like: view_certs -prefix "srv-name"
# Find $config value by running "certutil" with NO OPTIONS
# increment last character to get next prefix (stop matching)
$nextprefix = $prefix.Remove($prefix.Length1) + [char]([int]$prefix[-1] + 1)
$columns = "CommonName,DispositionMessage,CertificateTemplate,NotBefore,NotAfter"
# Disposition of 20 returns only "Issued" certificates
$restriction = "CommonName >= $prefix,CommonName < $nextprefix,Disposition = 20"
if ($config -ne $null) {
certutil.exe view config "$config" restrict "$restriction" out "$columns"
} else {
certutil.exe view restrict "$restriction" out "$columns"
}
}
# example calling function for hostname beginning with prefix
view_certs prefix "srv-name"
# Inspired by
#https://blogs.technet.microsoft.com/pki/2008/10/03/disposition-values-for-certutil-view-restrict-and-some-creative-samples/

view raw
view_certs.ps1
hosted with ❤ by GitHub

Code search keywords: certutil, view, restrict, CommonName, Disposition, DispositionMessage, CertificateTemplate, NotBefore, NotAfter

This was inspired by the following:

About notesbytom

Keeping technology notes on WordPress.com to free up my mind to solve new problems rather than figuring out the same ones repeatedly :-).
This entry was posted in System Administration and tagged , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s