ADFS token certificate expiration monitoring

[RogerSpraggon]

We monitor number of our certificates for expiry purposes and this works fine.
What we are trying to do now is monitor ADFS Token Signing certificates as these auto renew but some of our Relying Party Trusts to not accept auto update and we need to advise them that certificate is about to change.
Is there a way to do this?

[KS-Soft Europe]

You may use "Shell Script" test method with cusom Powershell script:

Code: Select all

$statusUnknown     = "ScriptRes:Unknown:"
$statusOk          = "ScriptRes:Ok:"
$statusBad         = "ScriptRes:Bad:"

if (!$args[0]) {
  echo  $statusUnknown"Cartificate expiration threshold is required."
  exit
}

$CertLimit = $args[0]
$CertExp = (NEW-TIMESPAN –Start (Get-Date) –End (Get-ADFSCertificate -CertificateType "Token-Signing" | where-object {$_.IsPrimary}).Certificate.NotAfter).Days
  
if ($CertExp -le $CertLimit)  {    echo $statusBad$CertExp } 
else {    echo $statusOk$CertExp }

Start cmd: powershell.exe %script% %params%

Script retrieves ADFS Token Signing active certificate and returns amount of days left to certificate expiration.

[RogerSpraggon]

Thank you script is brilliant and works when I run locally from PowerShell on our ADFS server.
Only thing I am struggling with now is how to get the host monitor system to execute this script on our ADFS server

[RogerSpraggon]

Its ok, I set up RMA on ADFS server and it works fine.
Thank you very much for a very prompt and fully working solution.

[KS-Soft Europe]

You are welcome !