This is a great first version! It will definitely replace the old camonitor.vbs script. Thanks a lot!

This is one of the intentions. Main intention is to provide more diagnostic functionality into my PSPKI module. Not sure if this appears in the next release of PSPKI, but at some point -- definitely.

Hello again, Some ideas for improvement (for which I have no idea whether it is technically feasible or not): * Add support for monitoring previous but still valid CA keys/certificates (in case of CA re-key/renewal). When we re-key a CA, it is important to monitor that AIA/CRL/OCSP are still available for the previous key, in order to keep valid already issued certificates. Using the Exchange certificate only allows to monitor the very latest CA key/certificate unfortunately. * Add support (maybe through an optional parameter of the script) to monitor standalone CAs as well and even non-Microsoft CAs. For each of those, no Exchange certificate is available but we could base the check on a certificate in the local store or through a file path. I happen to have both use cases. For the second, I'm having a complex hierarchy where the root and some subCAs are based on a non-Microsoft solution while other subCAs run ADCS. I need to check the availability of each of their AIA/CDP/OCSP, regardless of the underlying solution. Besides, I also have another ADCS hierarchy in a different AD forest that I'd like to monitor from the same server/script. Being able to pass as parameter additional certificates for which to check the chain could help on this matter. Again, thanks a lot for your work.

Hi Vadims, Like the previous commenter - I think your work is ace and much appreciated. I've run into a little problem with the Enterprise PKI script though. Just as a background, in this test instance, I have a single Enterprise CA beneath an offline MS Root. There are four CDPs / AIAs - only the first and last CDPs are reachable from the location where I run the script (i.e. it is expected that CDP 2 and 3 are not reachable). I guess the errors are mainly related to messages rather than PSPKI functions as such? Can you possibly explain? Thanks, Chipeater .\EnterprisePKI.ps1 ==================== Chipeater Class 3 Primary CA ==================== Exception calling "GetMessage" with "1" argument(s): "No error messages are assoicated with error code: 12007 Operation failed." At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSPKI\Client\Get-ErrorMessage.ps1:11 char:2 + [PKI.Utils.Error]::GetMessage($ErrorCode) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : Exception Exception calling "GetMessage" with "1" argument(s): "No error messages are assoicated with error code: 12007 Operation failed." At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSPKI\Client\Get-ErrorMessage.ps1:11 char:2 + [PKI.Utils.Error]::GetMessage($ErrorCode) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : Exception Name : Chipeater Class 3 Primary CA Status : Error ChainStatus : NoError URLs : {AIA Location #1: http://epkicrl/epki/Chipeater Class 3 Primary CA.crt, expire: 25/09/2024 14:21:00, Status: Ok, AIA Location #2: http://IAMCS/pki/mps/Chipeater Class 3 Primary CA.crt, expire: , Status: FailedToDownload, AIA Location #3: http://epki.chipeater.uk/epki/Chipeater Class 3 Primary CA.crt, expire: , Status: FailedToDownload, AIA Location #4: http://chipeater.uk/epki/Chipeater Class 3 Primary CA.crt, expire: 25/09/2024 14:21:00, Status: Ok...} Childs : Exception calling "GetMessage" with "1" argument(s): "No error messages are assoicated with error code: 12007 Operation failed." At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSPKI\Client\Get-ErrorMessage.ps1:11 char:2 + [PKI.Utils.Error]::GetMessage($ErrorCode) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : Exception Exception calling "GetMessage" with "1" argument(s): "No error messages are assoicated with error code: 12007 Operation failed." At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSPKI\Client\Get-ErrorMessage.ps1:11 char:2 + [PKI.Utils.Error]::GetMessage($ErrorCode) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : Exception Name : Chipeater Root CA Status : Error ChainStatus : NoError URLs : {AIA Location #1: http://epkicrl/epki/Chipeater Root CA.crt, expire: 23/07/2034 15:09:24, Status: Ok, AIA Location #2: http://IAMCS/pki/mps/Chipeater Root CA.crt, expire: , Status: FailedToDownload, AIA Location #3: http://epki.chipeater.uk/epki/Chipeater Root CA.crt, expire: , Status: FailedToDownload, AIA Location #4: http://chipeater.uk/epki/Chipeater Root CA.crt, expire: 23/07/2034 15:09:24, Status: Ok...} Childs :

> Add support for monitoring previous but still valid CA keys/certificates I can do this. I'll put a note for myself to implement this. > Add support (maybe through an optional parameter of the script) to monitor standalone CAs Standalone CAs do not support key archival, as the result I can't get CA Exchange certificate. Needs another way. > I need to check the availability of each of their AIA/CDP/OCSP, regardless of the underlying solution. hard to say. I can do this as well. Don't get me wrong, it is technically possible (I don't see much problems for me to code this). I need to reevaluate this request.

To Chipeater, you are right, it is related to error code resolver. The error 12007 stands for ERROR_INTERNET_NAME_NOT_RESOLVED -- "The server name or address could not be resolved" However, the real problem is unknown for me, as my error code handles network-related errors. Can you confirm that wininet.dll library is installed in system32 folder on your system?

Hi Vadims, Like the previous commenter - I think your work is ace and much appreciated. I've run into a little problem with the Enterprise PKI script though. Just as a background, in this test instance, I have a single Enterprise CA beneath an offline MS Root. There are four CDPs / AIAs - only the first and last CDPs are reachable from the location where I run the script (i.e. it is expected that CDP 2 and 3 are not reachable). I guess the errors are mainly related to messages rather than PSPKI functions as such? Can you possibly explain? Thanks, Chipeater .\EnterprisePKI.ps1 ==================== Chipeater Class 3 Primary CA ==================== Exception calling "GetMessage" with "1" argument(s): "No error messages are assoicated with error code: 12007 Operation failed." At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSPKI\Client\Get-ErrorMessage.ps1:11 char:2 + [PKI.Utils.Error]::GetMessage($ErrorCode) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : Exception Exception calling "GetMessage" with "1" argument(s): "No error messages are assoicated with error code: 12007 Operation failed." At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSPKI\Client\Get-ErrorMessage.ps1:11 char:2 + [PKI.Utils.Error]::GetMessage($ErrorCode) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : Exception Name : Chipeater Class 3 Primary CA Status : Error ChainStatus : NoError URLs : {AIA Location #1: http://epkicrl/epki/Chipeater Class 3 Primary CA.crt, expire: 25/09/2024 14:21:00, Status: Ok, AIA Location #2: http://IAMCS/pki/mps/Chipeater Class 3 Primary CA.crt, expire: , Status: FailedToDownload, AIA Location #3: http://epki.chipeater.uk/epki/Chipeater Class 3 Primary CA.crt, expire: , Status: FailedToDownload, AIA Location #4: http://chipeater.uk/epki/Chipeater Class 3 Primary CA.crt, expire: 25/09/2024 14:21:00, Status: Ok...} Childs : Exception calling "GetMessage" with "1" argument(s): "No error messages are assoicated with error code: 12007 Operation failed." At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSPKI\Client\Get-ErrorMessage.ps1:11 char:2 + [PKI.Utils.Error]::GetMessage($ErrorCode) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : Exception Exception calling "GetMessage" with "1" argument(s): "No error messages are assoicated with error code: 12007 Operation failed." At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSPKI\Client\Get-ErrorMessage.ps1:11 char:2 + [PKI.Utils.Error]::GetMessage($ErrorCode) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : Exception Name : Chipeater Root CA Status : Error ChainStatus : NoError URLs : {AIA Location #1: http://epkicrl/epki/Chipeater Root CA.crt, expire: 23/07/2034 15:09:24, Status: Ok, AIA Location #2: http://IAMCS/pki/mps/Chipeater Root CA.crt, expire: , Status: FailedToDownload, AIA Location #3: http://epki.chipeater.uk/epki/Chipeater Root CA.crt, expire: , Status: FailedToDownload, AIA Location #4: http://chipeater.uk/epki/Chipeater Root CA.crt, expire: 23/07/2034 15:09:24, Status: Ok...} Childs :

Hi Vadims, I can confirm that the wininet.dll library is indeed present in the System32 folder. Cheers, Dave

Another way of improvement I can think of: do not hardcode expiration notification threshold but instead use (configurable) percentage values of the certificate/CRL lifetime.

This is already in my list. I was too lazy to move them to parameters. > use (configurable) percentage values I took original pkiview.msc, where absolute values are used. Is it necessary to use percentage?

For me absolute values is not good. I have a 3-tier hierarchy where the root and policy CAs are offline and have CRLs valid for 1 month whereas signing CAs are online with CRLs valid for 2 days and published every day. Publication of signing CAs CRLs is automatic and an alert should be triggered somewhere 18 hours before expiration whereas for offline CAs, this is a manual process (requiring HSM operators presence) that needs to be scheduled ahead of time so 18 hours would be way too short for instance. Speaking about HSMs, I have an error when the script tries to call GetCAExchangeCertificate() on an enterprise CA with HSM operator cards protection. This CA does not do key archival and we never need Exchange certs then. When the scripts calls the method, the CA tries to generate a new Exchange certificate, which triggers the HSM CSP prompt for operator card which never times out. I had to kill the powershell process because even CTRL+C did not exit the script. There is probably a bug in the HSM CSP but it would be great to have some sort of timeout on such operations.

Ok I will make further research and will try to find an optimal solution. > There is probably a bug in the HSM CSP but it would be great to have some sort of timeout on such operations. I can't do much here. All calls are synchronous and depend on underlying DCOM connections. However I'm planning to support alternate methods (by passing already issued certificates in the case of Standalone CAs) where you can avoid CA Exchange certificate retrieval. p.s. currently I'm passing exams at university, therefore I will be able to write the code in february.

Yes that should be good! Although it would need to be available for enterprise CAs as well (as opt-in) in order for my use case to be usable. But don't worry. If too complicated to implement and too specific a use case, I'll deal with adapting the script for my particular use case myself. Good luck for your exams in the meantime!

> Although it would need to be available for enterprise CAs as well alternate input methods will be CA-independent. When you pass certificate as an input, the code will not contact CAs, instead it will use only information available in the certificate. > If too complicated to implement and too specific a use case, I'll deal with adapting the script for my particular use case myself. it is not complicated. I consider your suggestion enough common (heterogenous networks and multi-vendor CAs) and will include this functionality. And percentage calculus as well. I think to include separate parameters for CA certs, Base and Delta CRLs (three additional parameters) thershold settings. As I said, currently I have to focus on other tasks. However I won't do anything in regards of GetCAExchangeCertificate method. It is something case-specific. > Good luck for your exams thanks!

> Add support for monitoring previous but still valid CA keys/certificates I checked the documentation and it seems that I can't do this. There is no way to access CA Exchange for previous CA certs. CA Exchange cert is available for the most recent CA certificate.

Hello! I was searching around the web for a way to easily document a PKI infrastructure. I've pulled the code (EnterprisePKI.ps1) - some of the code is a bit more advanced (the DLL leveraging) than me - but I think I can read along and get the concept. However, what I seem to be missing is some dependencies that this script may have on other modules, cmdlets, or tools.... namely it fails at "Get-CA" on line 311. I saw at the top of the code that it had a dependency on 3.0, which I initially assumed to be PowerShell 3.0, but I strongly suspect now it is the PS PKI Module on CodePlex? I looked it over and it seems to have a rich feature set, but doesn't appear to have the Get-CA cmdlet (or an alias for it). Is there something you have done for your environment that I missed? Thanks, Andy

Turns out I didn't read ALL of the documentation on the PS PKI Module on CodePlex. May I throw 2 cents in and suggest a plug for the module at the top of your script and swap: >#requires -Version 3.0 for >#requires -Version 3.0 of http://pspki.codeplex.com/ Thanks!

#requires -version x.y -- it is an instruction, not a comment. PowerShell reads this line and throws exception if current PS version is lower than specified in this line. Therefore, your suggested line won't work. I made a note about dependencies in the blog post.

I don't see a link to your automation powershell script, only to the pki module.  Please provide a link.  Thank You

Where is the link? 

Thank's 

The most recent and actual version is on Github: https://github.com/Crypt32/PSPKI/blob/master/PSPKI/Server/Get-EnterprisePKIHealthStatus.ps1