AD CS Certificate Health Report

Description

Internal PKI is the kind of infrastructure nobody thinks about until it breaks: and when it breaks, it takes down LDAPS, RADIUS/802.1x, an internal web app, or worst case the CA itself, usually with very little warning. AD CS Certificate Health Report is a PowerShell tool that scans your Certification Authority and turns that risk into a single, clear, interactive HTML report.

What it checks: issued certificate expiry; the CA’s own certificate expiry (always Critical: this breaks validation fleet-wide, and needs re-keying); CRL health, including a lapsed CRL, which breaks revocation checking domain-wide; certificate templates with weak key lengths or a weak CA signing hash; certificate templates with the AD CS “ESC1” privilege-escalation pattern, where an enrollee can supply their own Subject Alternative Name and authenticate as any identity, including a Domain Admin; the CA service itself being down or unreachable; and templates that have issued nothing in a year or more, still an attack surface even unused.

What you get: a 0-100 health score, a filterable and sortable findings table, and an expandable evidence and guidance panel on every finding, showing exactly what was found and what to do about it: all built into one self-contained HTML file with no internet connection or install needed to view it.

Requirements: run on the Enterprise CA server itself, signed in with an account that can read the CA database (CA Administrator, CA Reader, or local Administrators – Domain Admin rights are not required). PowerShell 5.1 or PowerShell 7. Uses certutil.exe, which ships with every Windows installation, so there is nothing extra to install. The ADCSAdministration module is used for certificate template inventory where available, and the tool falls back to certutil -CATemplates automatically when it is not. Read-only: it never changes anything on your CA.

Fully customisable: set your own or your client’s branding, expiry and CRL warning thresholds, and output location, all via command-line parameters. Full instructions included.

Licence: for use by the purchasing individual or organisation, including running it for your own MSP clients. Not to be resold or redistributed as a standalone download. See the included LICENSE.txt for full terms.

Video demo

Our other pro tools

Questions before you buy? Get in touch.