banshee/active-directory-collection/active-directory/ssh/adcs

Certification authority, by SSH

Returns the state of the service of a certification authority of Active Directory Certificate Services, and the days left before the certificate of the authority expires. Two watches are proposed, both checked: the service stopped, and the certificate of the authority expiring.

Versions

Windows Server 2012 and later with the role Active Directory Certificate Services, and Windows PowerShell 3.0 or later, as the prerequisites name them. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real certification authority.

How it works

The collector runs one PowerShell command that reads the service, then the certificates the authority publishes in its CertEnroll folder:

powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; $state = [string](Get-CimInstance Win32_Service -Filter 'Name=''CertSvc''').State; $folder = Join-Path $env:windir 'System32\CertSrv\CertEnroll'; $subject = ''; $days = ''; if (Test-Path $folder) { $latest = Get-ChildItem $folder -Filter '*.crt' | ForEach-Object { New-Object Security.Cryptography.X509Certificates.X509Certificate2($_.FullName) } | Sort-Object NotAfter | Select-Object -Last 1; if ($latest) { $subject = $latest.Subject; $days = [long]($latest.NotAfter.ToUniversalTime() - [DateTime]::UtcNow).TotalDays } }; ConvertTo-Json -Compress -InputObject @{service = $state; subject = $subject; days = $days}"

The service is CertSvc, read in Win32_Service; its state is written by WMI in English whatever the language of the system, and returned in lower case, words joined by -: running, stopped…
The authority publishes its certificate and its revocation lists in %windir%\System32\CertSrv\CertEnroll (Microsoft, "Copy the CA certificate and CRL to the virtual directory"). Each .crt file there is read by the class X509Certificate2 of .NET; the one that expires last is taken as the current certificate of the authority, the former ones staying beside it after a renewal. days-left is counted in whole days, in UTC; certificate is the subject of that certificate.
The service not installed stops the collector as misconfigured, as does a CertEnroll folder without a certificate, or an answer that is not the expected JSON.

Nothing is written to the Windows: the command only reads.

Prerequisites

A Windows Server 2012 or later with the role Active Directory Certificate Services, its certification authority installed, with Windows PowerShell 3.0 or later.
The OpenSSH server of Windows, installed and started, its default shell left at cmd.exe, the Windows firewall open to the poller on TCP 22, and the fingerprint of its host key set in protocol:ssh:fingerprint unless the Security settings trust the first SSH fingerprint presented: the steps are those of the windows/ssh/services collector of banshee/windows-collection.
An account for monitoring, without administrator rights, set in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key. No group, and no role on the certification authority: the certificates of CertEnroll are public, published for any client to fetch.

Outputs

Name	Label	Unit	Per instance
`service`	Certificate Services	—	no
`certificate`	Certificate of the authority	—	no
`days-left`	Before the certificate expires	d	no

Watches

Name	Title	Kind	Defaults	Checked by default
`service-stopped`	Certificate Services stopped	expected value, on `service`	critical when the service is anything but `running`	yes
`expiring`	Authority certificate expiring	low threshold, on `days-left`	warning below 180 d, critical below 60 d	yes

The certificates an authority issues do not outlive its own: the renewal of its certificate is planned well ahead, hence the long defaults.

Limits

The expiry of the certificate revocation list (CRL) is not read here: deploy active-directory/https/crl, which reads it at its distribution point, over HTTP, once per CRL (the base CRL, and its delta when the authority publishes one). An expired CRL makes every certificate of the authority fail its revocation check. The .NET Framework of Windows PowerShell has no class that reads a CRL, and certutil, which does, writes its answer as text for a reader.
A .crt file of another authority copied into CertEnroll, a root authority beside a subordinate one, is read as well: if it expires last, it is the one returned. The subject in certificate says which.
Not yet checked on a real certification authority: the execution; that an account without administrator rights reads CertEnroll.