Pulling SSL certs from a local Certificate store

I am wondering if any one has been able to pull SSL certificate info from a servers local computer certificate store. I can get on the server and run the below PowerShell command and it pulls all of the SSL certificates that i expect. When i create a custom datasource to run this same PowerShell command its only pulling the SSL certificates for my local session.

Get-item Cert:\LocalMachine\my\* | select-object certificatedomains,issuer,status,notbefore,subject

I can run this command without admin rights, i am suspecting that Logic Monitor is using WMI to run this and for some reason it isnt allow of some sort. I have searched all of the docs and cannot find anything on how to do this. Any help is greatly appreciated.

jhipes

Posted 3 years ago·Last reply 3 years ago

4 comments

LM User

·3 years ago

https://community.logicmonitor.com/product-discussions-22/code-review-for-modules-in-the-exchange-3441?postid=11436#post11436

jhipes

OP3 years ago

This is fantastic, I am going to give this a try. I really appreciate the help.

mnagel

·3 years ago

I created a module for this some time back -- should be in the Exchange. I just looked at ours, though, and it is marked ‘Security Review’ which is super annoying since it was submitted 2 years ago at least -- LM has no apparent workflow for the Exchange, just have to find the right person to poke (if you get lucky). There should at least be some sort of “escalate” button on those to get someone’s attention.

I also don’t think the version posted is our current version (we added some code later to avoid expired certs in some cases). Here is the full source code (AD and collection). Somewhat ironically, the code handler for the forum post editor does not include “PowerShell”.

$TargetHostName = '##SYSTEM.SYSNAME##'<br/>$CollectorHostName = $env:computername<br/>$TargetUserName = '##wmi.user##'<br/>$TargetPassword = '##wmi.pass##'<br/>$DebugMode = $false<br/><br/><br/>$ScriptBlock = {<br/>    param (<br/>        [bool]$Debug<br/>    )<br/><br/>    # Certificates need to have a lifespan of at least this number of days to be considered.<br/>    $MinLifeSpan = 30<br/><br/>    # Certificates that are expired by more than this many days are ignored.<br/>    $MaxExpired = 60<br/><br/>    $AllCerts = @()<br/>    $CertExpire = @{}<br/><br/><br/>    $CertList = Get-ChildItem -Path cert:LocalMachine -Recurse -SSLServerAuthentication <br/>    Foreach ($Cert in $CertList) {<br/>        $SerialNumber = $Cert.SerialNumber<br/>        $FriendlyName = $Cert.FriendlyName;<br/>        $Name = ""<br/>        if ($FriendlyName -eq "") <br/>        { <br/>            $Name = $SerialNumber <br/>        }<br/>        else<br/>        {<br/>            $Name = "$FriendlyName - $SerialNumber"<br/>        }<br/><br/>        $NotBefore = $Cert.NotBefore<br/>        $NotAfter  = $Cert.NotAfter<br/>        $LifeSpan  = New-TimeSpan -Start $NotBefore -End $NotAfter<br/>        $LifeSpanDays = $LifeSpan.Days<br/><br/>        $Expired = New-TimeSpan -Start $NotAfter -End (Get-Date)<br/>        $ExpiredDays = $Expired.Days<br/><br/>        if (($SerialNumber -ne "") -AND ($LifeSpanDays -gt $MinLifeSpan) -AND ($ExpiredDays -lt $MaxExpired)) {<br/>            $Props = @()<br/>            $propPrefix = "auto.windowscerts"<br/>            $Props += "${propPrefix}.serialnum=$SerialNumber"<br/>            $Store = ($Cert.PSParentPath -split "::")[1]<br/>            #<br/>            # Add this store to the cert expiration tracking hashtable if it isn't<br/>            # there already<br/>            #<br/>            if ( -not $CertExpire.ContainsKey($Store) ){<br/>                $CertExpire[$Store] = @{}<br/>            }<br/><br/>            $Props += "${propPrefix}.lifespan_days=$LifeSpanDays"<br/><br/>            if ($Store -ne "") { $Props += "${propPrefix}.store=$Store" }<br/>            if ($NotBefore -ne "") { $Props += "${propPrefix}.starts=$NotBefore" }<br/>            if ($NotAfter -ne "") { $Props += "${propPrefix}.expires=$NotAfter" }<br/>            $Subject = $Cert.Subject<br/>            if ($Subject -ne "") { $Props += "${propPrefix}.subject=$Subject" }<br/>            $Issuer = $Cert.Issuer<br/>            if ($Issuer -ne "") { $Props += "${propPrefix}.issuer=$Issuer" }<br/>            $Thumbprint = $Cert.Thumbprint<br/>            if ($Thumbprint -ne "") { $Props += "${propPrefix}.thumbprint=$Thumbprint" }<br/>            $DNSNameList = $Cert.DNSNameList<br/>            if ($DNSNameList -ne "") { $Props += "${propPrefix}.dnsnames=$DNSNameList" }<br/><br/>            # If $ExpiredDays is negative it means the cert has not expired yet.<br/>            # We care about all non-expired certs but only the most recent of expired certs with <br/>            # the same CN in the same store<br/>            $AllCerts += @{<br/>                Subject      = $Subject<br/>                Store        = $Store<br/>                Name         = $Name<br/>                SerialNumber = $SerialNumber<br/>                ExpiredDays  = $ExpiredDays<br/>                Props        = $Props<br/>            }<br/><br/>            if ( $CertExpire[$Store].ContainsKey($Subject) ){<br/>                if ( $ExpiredDays -lt $CertExpire[$Store][$Subject] ){<br/>                    $CertExpire[$Store][$Subject] = $ExpiredDays<br/>                }<br/>            }<br/>            else {<br/>                $CertExpire[$Store][$Subject] = $ExpiredDays<br/>            }<br/><br/>            # Write-Host "$SerialNumber##$Name##$Subject####", ($Props -join '&')<br/>        }<br/>    }<br/>    foreach ( $Cert in $AllCerts ){<br/>        $Subject     = $Cert.Subject<br/>        $Store       = $Cert.Store<br/>        $ExpiredDays = $Cert.ExpiredDays<br/><br/><br/>        if ( ($ExpiredDays -gt 0) -AND ($ExpiredDays -gt $CertExpire[$Store][$Subject]) ){<br/>            # Don't care about expired certs when a newer one exists in the same store<br/>            # with the same Subject<br/>            continue<br/>        }<br/><br/>        $SerialNumber = $Cert.SerialNumber<br/>        $Name         = $Cert.Name<br/>        $Props        = $Cert.Props<br/><br/>        Write-Host "$SerialNumber##$Name##$Subject####", ($Props -join '&')<br/>    }<br/>}<br/><br/>if ($TargetHostName -eq $CollectorHostName)<br/>{<br/>    Invoke-Command -ScriptBlock $ScriptBlock -ArgumentList @($DebugMode)<br/>}<br/>else<br/>{<br/>    #If WMI creds undefined - invoke remote command without creds, if not - create credential object and use it for authorization<br/>    if (($TargetUserName -Match "wmi.user" -and $TargetPassword -Match "wmi.pass") -or <br/>        ($TargetUserName -eq "" -and $TargetPassword -eq ""))<br/>    {<br/>        Invoke-Command -ComputerName $TargetHostName -ScriptBlock $ScriptBlock -ArgumentList @($DebugMode)<br/>    }<br/>    else<br/>    {<br/>        $TargetCredentials = New-Object System.Management.Automation.PSCredential ($TargetUserName, $(ConvertTo-SecureString $TargetPassword -AsPlainText -Force))<br/>        Invoke-Command -ComputerName $TargetHostName -ScriptBlock $ScriptBlock -Credential $TargetCredentials -ArgumentList @($DebugMode)<br/>    }<br/>}<br/><br/>Exit 0 <br/>

$Instance = '##WILDVALUE##'<br/>$TargetHostName = '##SYSTEM.SYSNAME##'<br/>$CollectorHostName = $env:computername<br/>$TargetUserName = '##wmi.user##'<br/>$TargetPassword = '##wmi.pass##'<br/>$DebugMode = $false<br/><br/>$ScriptBlock = {<br/>    param (<br/>        [bool]$Debug,<br/>        [String]$SerialNumber<br/>    )<br/><br/>    if ($Cert = Get-ChildItem -Path cert:LocalMachine -Recurse | Where-Object { $_.SerialNumber -eq $SerialNumber }) {<br/>        # NotAfter can return multiple values, we'll just take the first (zeroth) one using [0]<br/>        $TimeSpan = New-TimeSpan -Start (Get-Date) -End $Cert.NotAfter[0]<br/>        $DaysLeft = $TimeSpan.Days<br/>        Write-Host "DaysLeft=$DaysLeft"<br/>    }<br/>}<br/><br/>if ($TargetHostName -eq $CollectorHostName)<br/>{<br/>    Invoke-Command -ScriptBlock $ScriptBlock -ArgumentList @($DebugMode,$Instance)<br/>}<br/>else<br/>{<br/>    #If WMI creds undefined - invoke remote command without creds, if not - create credential object and use it for authorization<br/>    if (($TargetUserName -Match "wmi.user" -and $TargetPassword -Match "wmi.pass") -or <br/>        ($TargetUserName -eq "" -and $TargetPassword -eq ""))<br/>    {<br/>        Invoke-Command -ComputerName $TargetHostName -ScriptBlock $ScriptBlock -ArgumentList @($DebugMode,$Instance)<br/>    }<br/>    else<br/>    {<br/>        $TargetCredentials = New-Object System.Management.Automation.PSCredential ($TargetUserName, $(ConvertTo-SecureString $TargetPassword -AsPlainText -Force))<br/>        Invoke-Command -ComputerName $TargetHostName -ScriptBlock $ScriptBlock -Credential $TargetCredentials -ArgumentList @($DebugMode,$Instance)<br/>    }<br/>}<br/><br/>Exit 0

Mike Moniz

·3 years ago

DataSource code always runs directly on the collector’s server, and it’s up to your code to connect to the relevant server with the SSL cert, unless you want to check the server the collector software is installed on. Might that be part of the issue?