banshee/active-directory-collection/active-directory/winrm/adcs

Certification authority, by WinRM

Returns the state of the service of a certification authority of Active Directory Certificate Services, and the days left before the certificate of the authority expires. Two watches are proposed, both checked: the service stopped, and the certificate of the authority expiring.

How it works

The collector runs one PowerShell script, by WinRM, that reads the service, then the certificates the authority publishes in its CertEnroll folder:

$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; $state = [string](Get-CimInstance Win32_Service -Filter 'Name=''CertSvc''').State; $folder = Join-Path $env:windir 'System32\CertSrv\CertEnroll'; $subject = ''; $days = ''; if (Test-Path $folder) { $latest = Get-ChildItem $folder -Filter '*.crt' | ForEach-Object { New-Object Security.Cryptography.X509Certificates.X509Certificate2($_.FullName) } | Sort-Object NotAfter | Select-Object -Last 1; if ($latest) { $subject = $latest.Subject; $days = [long]($latest.NotAfter.ToUniversalTime() - [DateTime]::UtcNow).TotalDays } }; ConvertTo-Json -Compress -InputObject @{service = $state; subject = $subject; days = $days}

WinRM hands the script to PowerShell itself: the script is the one of active-directory/ssh/adcs, without the powershell -Command "…" that cmd.exe needs there.
The service is CertSvc, read in Win32_Service; its state is written by WMI in English whatever the language of the system, and returned in lower case, words joined by -: running, stopped…
The authority publishes its certificate and its revocation lists in %windir%\System32\CertSrv\CertEnroll (Microsoft, "Copy the CA certificate and CRL to the virtual directory"). Each .crt file there is read by the class X509Certificate2 of .NET; the one that expires last is taken as the current certificate of the authority, the former ones staying beside it after a renewal. days-left is counted in whole days, in UTC; certificate is the subject of that certificate.
The service not installed stops the collector as misconfigured, as does a CertEnroll folder without a certificate, or an answer that is not the expected JSON.

Nothing is written to the Windows: the script only reads.

Prerequisites

A Windows Server 2012 or later with the role Active Directory Certificate Services, its certification authority installed, with Windows PowerShell 3.0 or later.
The WinRM service listening in HTTPS, on TCP 5986 or the port set in protocol:winrm:port, open in the Windows firewall to the poller, with a certificate the poller judges by the TLS profile of the probe or pins in protocol:winrm:fingerprint: the steps are those of the windows/winrm/services collector of banshee/windows-collection. NTLM authentication, which the WinRM service accepts as installed.
An account for monitoring, without administrator rights, set in protocol:winrm:user (DOMAIN\account or account@domain) with its password in protocol:winrm:password, member of the local group "Remote Management Users" (of the domain on a domain controller). No other group, and no role on the certification authority: the certificates of CertEnroll are public, published for any client to fetch.

Outputs

Name	Label	Unit	Per instance
`service`	Certificate Services	—	no
`certificate`	Certificate of the authority	—	no
`days-left`	Before the certificate expires	d	no

Watches

Name	Title	Kind	Defaults	Checked by default
`service-stopped`	Certificate Services stopped	expected value, on `service`	critical when the service is anything but `running`	yes
`expiring`	Authority certificate expiring	low threshold, on `days-left`	warning below 180 d, critical below 60 d	yes

The certificates an authority issues do not outlive its own: the renewal of its certificate is planned well ahead, hence the long defaults.

Limits

The expiry of the certificate revocation list (CRL) is not read here: deploy active-directory/https/crl, which reads it at its distribution point, over HTTP, once per CRL (the base CRL, and its delta when the authority publishes one). An expired CRL makes every certificate of the authority fail its revocation check. The .NET Framework of Windows PowerShell has no class that reads a CRL, and certutil, which does, writes its answer as text for a reader.
A .crt file of another authority copied into CertEnroll, a root authority beside a subordinate one, is read as well: if it expires last, it is the one returned. The subject in certificate says which.
Not yet checked on a real certification authority: the execution; that an account without administrator rights reads CertEnroll.