Monitoring AD CS issued certs ?

Question

Has anyone come across any good tools for monitoring certificates in particular their life time ?  I know possible through SCOM but the issue is when you need to monitor many different certificates from many different environments it becomes difficult
to apply different metrics. 
Is there a ready built tool or script which is easy to manage and use which can either query the CA database periodically for particular certs and their expiry and alert when they are 50%, 60%, 70%...through their life time or a tool which can
look in a folder for CERs and check the expiry.
Thanks in advance !

Answer 1

I'm not aware about ready solutions, but some frameworks exist. For example, in PowerShell you can query CA database, select non-expired certificates, calculate lifetime and report if necessary. For example, with
PowerShell PKI module you could do this:
$requests = Get-CA ca01.company.com | Get-IssuedRequest -Filter "NotAfter -gt $(Get-Date)" -Property "CertificateTemplate" | %{
$lifetime = (((Get-Date) - $_.NotBefore).days / ($_.NotAfter - $_.NotBefore).days) * 100
Write-Host "Certificate issued to '$($_.CommonName)' based on template '$($_.CertificateTemplate)' reached $lifetime % of lifetime"
this code will type lifetime to a console. You can replace Write-Host cmdlet with your own handler. $lifetime variable will store elapsed lifetime in percents.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool.