Monitoring pending certificate expirations

Question

We have a number of public web sites that use certificates and we'd like to use SCOM to provide warnings about pending certificate expirations.     Is there a certficate services management pack, or a monitor or rule in an existing pack (like the IIS or windows OS packs) that will tell us when a given certificate is about to expire? 

Answer 1

Shajeer,
The only way to really do this is to query the local certificate store on each server.    This is possible with powershell,  but you must have powershell installed on any server that you wish to monitor.  (I believe it's there by default for Win2k8, but you'll need to install it on Win2k3 servers). 
Here's a power shell script that will query the local computer store and perform date arithmatic to determine if any resident certs will expire in 30 days or less.   If any are found, then it will call the eventcreate utility that's native to windows to generate an eventID number 989.      You can then create a monitor that checks for this event ID.      But first you'll need to run this script on a periodic basis, which you can do by creating a Timed Event rule.     Unfortunately, the timed event rules let you either run a VBS script or an OS command, but not a powershell script.  So we have to use the OS command option to run powershell.    The OS command you would run is     powershell.exe -file  certtest.ps1           This causes some additional complications because the contents of the script below would have to be placed into a file called certtest.ps1, and then this file would have to be distributed to a common directory on any server you want to monitor.      You could alternatively use the Task Scheduler service on each machine to run this script periodically, but that get tedious in large environments.  
Of course, you could always write a .vbs script and then you could put the script logic directly in the rule,  but I'm not much of a VB programmer.      
*** Start of Script ***
$currentdate = get-date
$certabouttoexpire = "false"
cd cert:\localmachine\my
$certstoredate = gci | % {$_.GetExpirationDateString()}
foreach($x in $certstoredate)
        $certdate = get-date "$x"
        $daysremaining = ($certdate - $currentdate).days
        if ($daysremaining -lt 30)
             $CertAboutToExpire = "True"
if ($certabouttoexpire -eq "True") {eventcreate /L System /T Warning /SO CertWarning /id 989 /D "A Certificate on this system will expire in 30 days or less.  Use the Certificates MMC snapin on this machine to identify the certificate"}
*** End Of Script ***