%3CLINGO-SUB%20id%3D%22lingo-sub-1128402%22%20slang%3D%22en-US%22%3EHow%20to%20determine%20all%20certificates%20that%20will%20expire%20within%2030%20days%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1128402%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSTRONG%3E%20First%20published%20on%20TECHNET%20on%20Apr%2024%2C%202008%20%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%20class%3D%22MsoNormal%22%20style%3D%22line-height%3A%20normal%3B%20margin%3A%200cm%200cm%2010pt%3B%20mso-margin-top-alt%3A%20auto%3B%20mso-margin-bottom-alt%3A%20auto%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20Woudn't%20it%20be%20interesting%20for%20the%20CA%20admin%20to%20know%20which%20certificates%20are%20expiring%20in%20the%20near%20future%3F%20If%20autoenrollment%20is%20not%20eanbled%2C%20certificate%20users%20should%20be%20informed%20in%20advance%20before%20they%20actually%20loose%20functionality.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22MsoNormal%22%20style%3D%22line-height%3A%20normal%3B%20margin%3A%200cm%200cm%2010pt%3B%20mso-margin-top-alt%3A%20auto%3B%20mso-margin-bottom-alt%3A%20auto%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20A%20simple%20certutil%20command%20enables%20the%20CA%20admin%20to%20generate%20a%20list%20with%20all%20expiring%20certificates%3A%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22MsoNormal%22%20style%3D%22line-height%3A%20normal%3B%20margin%3A%200cm%200cm%2010pt%3B%20mso-margin-top-alt%3A%20auto%3B%20mso-margin-bottom-alt%3A%20auto%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Arial'%2C'sans-serif'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22line-height%3A%20115%25%3B%20font-family%3A%20'Courier%20New'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-ansi-language%3A%20de%3B%20mso-fareast-language%3A%20de%3B%20mso-bidi-language%3A%20ar-sa%3B%22%3E%20certutil%20%E2%80%93view%20%E2%80%93restrict%20%22NotAfter%26lt%3B%3DMay%205%2C2008%2008%3A00AM%2CNotAfter%26gt%3B%3DApril%2024%2C2008%2008%3A00AM%22%20%E2%80%93out%20%22RequestID%2CRequesterName%22%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20'Arial'%2C'sans-serif'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Arial'%2C'sans-serif'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22line-height%3A%20115%25%3B%20font-family%3A%20'Courier%20New'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-ansi-language%3A%20de%3B%20mso-fareast-language%3A%20de%3B%20mso-bidi-language%3A%20ar-sa%3B%22%3E%20%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22MsoNormal%22%20style%3D%22line-height%3A%20normal%3B%20margin%3A%200cm%200cm%2010pt%3B%20mso-margin-top-alt%3A%20auto%3B%20mso-margin-bottom-alt%3A%20auto%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20Since%20I%20mentioned%20autoenrollment%20above%2C%20here%20is%20a%20trick%20how%20to%20determine%20if%20a%20certificate%20was%20enrolled%20manually%20or%20with%20autoenrollment.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20'Arial'%2C'sans-serif'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Arial'%2C'sans-serif'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22MsoNormal%22%20style%3D%22line-height%3A%20normal%3B%20margin%3A%200cm%200cm%2010pt%3B%20mso-margin-top-alt%3A%20auto%3B%20mso-margin-bottom-alt%3A%20auto%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20%3CSPAN%20style%3D%22font-family%3A%20'Arial'%2C'sans-serif'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22line-height%3A%20115%25%3B%20font-family%3A%20'Courier%20New'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-ansi-language%3A%20de%3B%20mso-fareast-language%3A%20de%3B%20mso-bidi-language%3A%20ar-sa%3B%22%3E%20%3CFONT%20color%3D%22%23000000%22%3E%20certutil%20%E2%80%93view%20-v%20-out%20rawrequest%20%7C%20findstr%20Process%20%3C%2FFONT%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20%3CSPAN%20style%3D%22font-family%3A%20'Arial'%2C'sans-serif'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22line-height%3A%20115%25%3B%20font-family%3A%20'Courier%20New'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-ansi-language%3A%20de%3B%20mso-fareast-language%3A%20de%3B%20mso-bidi-language%3A%20ar-sa%3B%22%3E%20%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22MsoNormal%22%20style%3D%22line-height%3A%20normal%3B%20margin%3A%200cm%200cm%2010pt%3B%20mso-margin-top-alt%3A%20auto%3B%20mso-margin-bottom-alt%3A%20auto%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20The%20above%20command%20can%20certainly%20be%20extended%20with%20the%20-restrict%20parameter%20to%20reduce%20the%20amount%20of%20output%20producted%20by%20the%20query.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Arial'%2C'sans-serif'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22MsoNormal%22%20style%3D%22line-height%3A%20normal%3B%20margin%3A%200cm%200cm%2010pt%3B%20mso-margin-top-alt%3A%20auto%3B%20mso-margin-bottom-alt%3A%20auto%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20The%20name%20of%20the%20task%20performing%20autoenrollment%20differs%20for%20different%20OS%20releases%20and%20possible%20for%20machine%20and%20user%20contexts.%20Manually%20requested%20certificates%20may%20show%20a%20process%20name%20like%20%3CEM%3E%20certreq%20%3C%2FEM%3E%20or%20%3CEM%3E%20cscript%20%3C%2FEM%3E%20.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Arial'%2C'sans-serif'%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22MsoNormal%22%20style%3D%22line-height%3A%20normal%3B%20margin%3A%200cm%200cm%2010pt%3B%20mso-margin-top-alt%3A%20auto%3B%20mso-margin-bottom-alt%3A%20auto%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20'Lucida%20Sans%20Unicode'%2C'sans-serif'%3B%20color%3A%20teal%3B%20font-size%3A%2010pt%3B%20mso-fareast-font-family%3A%20'Times%20New%20Roman'%3B%20mso-fareast-language%3A%20de%3B%22%3E%20To%20learn%20more%20how%20to%20notify%20users%20of%20certificate%20expiration%2C%20see%20%3CA%20href%3D%22http%3A%2F%2Fblogs.msdn.com%2Fspatdsg%2Farchive%2F2007%2F07%2F19%2Fnotify-users-of-cert-expiration.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.msdn.com%2Fspatdsg%2Farchive%2F2007%2F07%2F19%2Fnotify-users-of-cert-expiration.aspx%20%3C%2FA%3E%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1128402%22%20slang%3D%22en-US%22%3E%3CP%3EFirst%20published%20on%20TECHNET%20on%20Apr%2024%2C%202008%20Woudn't%20it%20be%20interesting%20for%20the%20CA%20admin%20to%20know%20which%20certificates%20are%20expiring%20in%20the%20near%20future%3F%20If%20autoenrollment%20is%20not%20eanbled%2C%20certificate%20users%20should%20be%20informed%20in%20advance%20before%20they%20actually%20loose%20functionality.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1128402%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECarstenKinder%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft

First published on TECHNET on Apr 24, 2008

Woudn't it be interesting for the CA admin to know which certificates are expiring in the near future? If autoenrollment is not eanbled, certificate users should be informed in advance before they actually loose functionality.

 

A simple certutil command enables the CA admin to generate a list with all expiring certificates:

 


certutil –view –restrict "NotAfter<=May 5,2008 08:00AM,NotAfter>=April 24,2008 08:00AM" –out "RequestID,RequesterName"



Since I mentioned autoenrollment above, here is a trick how to determine if a certificate was enrolled manually or with autoenrollment.

 


certutil –view -v -out rawrequest | findstr Process



The above command can certainly be extended with the -restrict parameter to reduce the amount of output producted by the query.

 

The name of the task performing autoenrollment differs for different OS releases and possible for machine and user contexts. Manually requested certificates may show a process name like certreq or cscript .

 

To learn more how to notify users of certificate expiration, see http://blogs.msdn.com/spatdsg/archive/2007/07/19/notify-users-of-cert-expiration.aspx