Windows Server Validate certificate chain with powershell

Key Steps in the Approach:​

1. Get the Issuer Certificate: Your function Get-IssuerCertificate is well-structured for retrieving the correct issuer using the issuer name and serial number. This will help ensure that you're identifying the specific certificate without confusion from other certificates that might share the same issuer name. Here’s how your function is structured:
   Code:

   powershell function Get-IssuerCertificate { param ( [Parameter(Mandatory = $true)] [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate ) $issuerName = $Certificate.Issuer $issuerSerialNumber = $Certificate.SerialNumber Get-ChildItem -Recurse -Path Cert: | Where-Object { $_.Issuer -eq $issuerName -and $_.SerialNumber -eq $issuerSerialNumber } }

2. Find the Closest-to-Expiration Certificate: The Get-NearestExpirationCertificate function should serve well to walk through the chain and find the certificate that is nearest to expiration. This helps in quickly identifying potential risks in the certificate chain. Here’s your function for finding the nearest expiration certificate:
   Code:

   powershell function Get-NearestExpirationCertificate { param ( [Parameter(Mandatory = $true)] [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate ) $chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain $chain.Build($Certificate) $nearestExpirationCertificate = $null $nearestExpirationDate = [datetime]::MaxValue foreach ($element in $chain.ChainElements) { $cert = $element.Certificate if ($cert.NotAfter -lt $nearestExpirationDate) { $nearestExpirationDate = $cert.NotAfter $nearestExpirationCertificate = $cert } } $nearestExpirationCertificate }