Why not use something like �Get-Certificate | Test-Certicate�? I bet you (or other guys) already have those functions. And if they don't work this way for some reason, it seems like a good opportunity to improve them, not reinventing the wheel.

because the code runs against remote web servers. In many cases the certificate locally may look as valid, but from client perspective � not. For example, certificate name mismatch, trust issues, revocation checking and so on.

So, why not make �Get-Certificate� so that it grabs it from those remove web servers? All as you did it here: Get-Certificate -Path "signin.ebay.com" -Port "443" -Proxy "someshithere.contoso.com" -ProxyPort "8080" -Timeout "100500" This should bring the remote certificate into the client-side perspective. Then pipe it to �Test-Certificate� which would obviously check it locally.

Currently I haven't a good design for universal Test-Certificate (it useless to have a separate Test-Certificate cmdlet for SSL certificates only). Probably, in future, when I will have a better solution.

why do you need a separate one? It should just accept output from Get-Certificate.

Currently I have no idea how to create a universal Test-Certificate command.

What is the input format your current implementation of Test-Certificate expects?

Clear Explanation.

THANK YOU! I have to sift through lots and lots of nodes and this is a LIFE Saver.

I have my own personal CA whose cert I have installed into the Trusted Root CAs. This way I can simulate the signing process and test configurations without the need for expensive commercial CA signed certs all the time. However, when I run your function against a server configured in this way, I get the following: CertificateIsValid : False ErrorInformation : {RevocationStatusUnknown} Not knowing much about SSL certs & revocation, is there any way I can configure things up so your function will generate a CertificateIsValid status of True for my test environments?

This is a big question. Revocation checking is one of the most (and complicated) subject in PKI. The most likely issue is that URLs in the certificate's CDP extension are not accessible from your client. Open the target certificate, and examine URLs in CRL Distribution Points extension.

I wish output valid from and valid to to this script. Any Ideas?

The script already outputs these values (as a part of the certificate). But you can add the following properties to object: public DateTime ValidFrom; public DateTime ValidTo; and in the code (within 'New-Object PKI.Web.WebSSL' hashtable) add the following lines: ValidFrom = $Cert.NotBefore; ValidTo = $Cert.NotAfter;

I tried adding "pubic DateTime ValidTo;" and "ValidTo = $Cert.NotAfter;" and I'm getting this error: Add-Type : Cannot add type. The type name 'PKI.Web.WebSSL' already exists. At C:\Temp\PowerShell\Test-SSL.ps1:16 char:9 + Add-Type <<<< @" + CategoryInfo : InvalidOperation: (PKI.Web.WebSSL:String) [Add-Type], Exception + FullyQualifiedErrorId : TYPE_ALREADY_EXISTS,Microsoft.PowerShell.Commands.AddTypeCommand New-Object : Member "ValidTo" not found for the given .NET object. At C:\Temp\PowerShell\Test-SSL.ps1:56 char:19 + New-Object <<<< PKI.Web.WebSSL -Property @{ + CategoryInfo : InvalidOperation: (:) [New-Object], InvalidOperationException + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.NewObjectCommand FYI - renamed the function to Test-SSL. I'd like to be able to grab the URL, SANs, Issuer, and expiration. I can get all but the expiration.

I tried adding "pubic DateTime ValidTo;" and "ValidTo = $Cert.NotAfter;" and I'm getting this error: Add-Type : Cannot add type. The type name 'PKI.Web.WebSSL' already exists. At C:\Temp\PowerShell\Test-SSL.ps1:16 char:9 + Add-Type <<<< @" + CategoryInfo : InvalidOperation: (PKI.Web.WebSSL:String) [Add-Type], Exception + FullyQualifiedErrorId : TYPE_ALREADY_EXISTS,Microsoft.PowerShell.Commands.AddTypeCommand New-Object : Member "ValidTo" not found for the given .NET object. At C:\Temp\PowerShell\Test-SSL.ps1:56 char:19 + New-Object <<<< PKI.Web.WebSSL -Property @{ + CategoryInfo : InvalidOperation: (:) [New-Object], InvalidOperationException + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.NewObjectCommand FYI - renamed the function to Test-SSL. I'd like to be able to grab the URL, SANs, Issuer, and expiration. I can get all but the expiration.

When you modified C# signature, you need to restart PowerShell console.

Thanks that did the trick! I really appreciate this script, it will help me tremendously!

Also I would like to advice you to try the PSPKI module: http://pspki.codeplex.com/ The module has an improved version of this command.

When I am trying to use it, it does not show anything on the screen, tried with and without -URL parameters

Any errors there? The function should return an exception or the formatted output.

Hi, I use this script to automatically verify certificate information in my environment. I've been able to use it to grab information in the certificate...but do you know how I might be able to get the OU value from the Subject string? Thanks in advance, Hank

You can use regular expressions to extract OU information. Though regex may be a bit complicated, because there may be multiple OU attributes. Or split subject name to tokens: $RDNs = (Test-WebServerSSL signin.ebay.com).Subject.Split(",").Trim() and index to $RDNs to get desired RDN attribute.

Seems the "https://$url`:$port" does not support the full uri path... For example... Redirects https:\\webserver - might redirect or produce a cert and https:\\webserver\folder - might redirect to a different place and produce a different cert in that case $ConnectString would produce https:\\webserver\folder:443 which produces a slew of errors... Exception calling "Create" with "1" argument(s): "Invalid URI: The hostname could not be parsed. At line:39 char:5 + $WebRequest = [Net.WebRequest]::Create($ConnectString) + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : UriFormatException Not a show stopper and surely not the norm but thought I would let you know since I ran into it. Scott

> Seems the "https://$url`:$port" does not support the full uri path... yes, currently it is not supported. You can fill a bug here: https://pspki.codeplex.com/workitem/list/basic

Thanks for this script! I'm going to try and add some email functionality to it but it is awesome! Thanks again.

This is awesome! Thank you!!!!!!!!

I used your code to develop a tool which tests for the signature algorithm of a web server. Turns out SHA-1 is being phased out in November, so we needed to check approximately 500 websites. This made it much easier. Code available here if you want/need it. https://gist.github.com/derekmurawsky/1345e55699343ec4ea9c Thanks!

PS C:\> Test-WebServerSSL ebay.com Exception calling "SendRequest" with "0" argument(s): "Object reference not set to an instance of an object." At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSPKI\Client\Test-WebServerSSL.ps1:26 char:2 + $Response.SendRequest() + ~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : NullReferenceException

I responded to you on CodePlex web site.

Hi, thanks for you code, but i prefer to use the windows tool - VerifySSLCertificate, the download link is borken, could you renew it ?

Your link to VerifySSLCertificate.zip is broken (404 not found).

Hi,

the script seems to be broken on Win10 1607 / Powershell5. I'n not familiar with using .NET Namespaces directly so I cannot fix this myself...

New-Object : The value supplied is not valid, or the property is read-only. Change the value, and then try again.
At line:54 char:9
+         New-Object PKI.Web.WebSSLTest -Property @{
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [New-Object], Exception
    + FullyQualifiedErrorId : SetValueException,Microsoft.PowerShell.Commands.NewObjectCommand

Please, open a report on issue tracker: https://pspki.codeplex.com/workitem/list/basic

For PowerShell 5 (and likely 3+) you could remove the add-type at the beginning and replace the new-object line by the following

<PoSHCode>

        $ConnectionInformation = New-Object PSObject -Property ([Ordered]@{ 
            OriginalUri = $ConnectString; 
            ReturnedUri = $Response.ResponseUri; 
            Certificate = [Security.Cryptography.X509Certificates.X509Certificate2]$WebRequest.ServicePoint.Certificate; 
            Issuer = $WebRequest.ServicePoint.Certificate.Issuer; 
            Subject = $WebRequest.ServicePoint.Certificate.Subject; 
            SubjectAlternativeNames = $SAN; 
            CertificateIsValid = $Status; 
            Response = $Response; 
            ErrorInformation = $chain.ChainStatus | ForEach-Object {$_.Status} 
        })
        $ConnectionInformation.PSObject.TypeNames.Add("Indented.LDAP.ConnectionInformation")
        $ConnectionInformation

</PoSHCode>

Don't yet understand how it works, just capturing out of http://www.indented.co.uk/2015/03/31/testing-ldaps

It appears that when a wildcard certificate is presented it assumes all subdomains as covered.

Example: Test-WebServerSSL -URL wrong.host.badssl.com
CertificateIsValid : True (Should be false)

Hello,

I´m not a programmer unf. could you help me on a code for check ssl based url to have certification autority name, data created and will expire,please?

I appreciate your help!

Test-WebServerSSL www.google.com
Test-WebServerSSL : Exception calling "GetResponse" with "0" argument(s): "The operation has timed out"
At line:1 char:1
+ Test-WebServerSSL www.google.com
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Test-WebServerSSL

Why with some web pages this works ok, but with others I'm getting response (let's say for non-valid certificates).

How can I check for all sites with valid and non-valid certificates?

Test-WebServerSSL : Exception calling "GetResponse" with "0" argument(s): "The operation has timed out"
At line:1 char:1
+ Test-WebServerSSL www.google.com
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Test-WebServerSSL

-or-

New-Object : The value supplied is not valid, or the property is read-only. Change the value, and then try again.
At line:54 char:9
+         New-Object PKI.Web.WebSSLTest -Property @{
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [New-Object], Exception
    + FullyQualifiedErrorId : SetValueException,Microsoft.PowerShell.Commands.NewObjectCommand

Commenting out ErrorInformation solved the error:

New-Object : The value supplied is not valid, or the property is read-only. Change the value, and then try again.
At C:\Users\bdoyle1\Test-WebServerSSL.ps1:54 char:9
+         New-Object PKI.Web.WebSSLTest -Property @{
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [New-Object], Exception
    + FullyQualifiedErrorId : SetValueException,Microsoft.PowerShell.Commands.NewObjectCommand

Alternately removing the "| ForEach-Object {$_.ChainStatus}" loop did the same.   

The problem seems to be if the chain status is empty {} PS5 can't handle it.

To prevent throw error: "New-Object : The value supplied is not valid, or the property is read-only. Change the value, and then try again."

Change line:

ErrorInformation = $chain.ChainStatus | ForEach-Object {$_.Status}

To Line:

ErrorInformation = $(IF($chain.ChainStatus){$chain.ChainStatus | ForEach-Object {$_.Status}} Else {$NULL})

Is it possible to add a property to this that would show the thumbprint in SHA256 rather than just in SHA1?