What about something like this:
Get-AdfsCertificate | ForEach-Object {
New-Object -TypeName psobject -Property @{
Type = $_.CertificateType
Thumbprint = $_.Thumbprint
ValidFrom = $_.Certificate.NotBefore
Expiration = $_.Certificate.NotAfter
}
} | Select-Object Type,Thumbprint,ValidFrom,Expiration
The output will look like this:
Type Thumbprint ValidFrom Expiration
---- ---------- --------- ----------
Service-Communications 8494AD111D438CB3DCDA76E50077A3CA67FC85A0 22.06.2017 00:00:00 20.09.2018 12:00:00
Token-Decrypting B83C6CBCA26782A5687292F4EB4F5DAFB1E9E314 04.05.2017 19:19:29 04.05.2018 19:19:29
Token-Signing 19F9BCBDEFDBFA9433015822F7D4A2CEBC4D85F7 04.05.2017 19:19:28 04.05.2018 19:19:28
Token-Signing 5C82633D6E2CECB0F69F58C56B3B7600A92B3237 13.11.2017 04:12:02 13.11.2018 04:12:02
You can customize it...You might also be interested on the event generated when stuff is about to expire:
Id : 434
Description : The primary AD FS certificate authority issuer certificate ( thumbprint %1 ) will expire at %2 UTC.
The certificate rollover service will roll over to the current secondary ( thumbprint %3 ) at %4 UTC.
To avoid certificate issuance service interruption, ensure that the current secondary certificate ( thumbprint %3 ) is installed in
Active Directory before the rollover occurs at %4 UTC.
Parameters :
Id : 436
Description : The primary AD FS token decryption certificate ( thumbprint %1 ) will expire at %2 UTC.
The certificate rollover service will roll over to the current secondary ( thumbprint %3 ) at %4 UTC.
Identity providers that rely on federation metadata will be notified automatically; any identity providers that send encrypted
tokens to AD FS and do not rely on federation metadata must be informed of the new certificate before the expiration at %2 UTC.
Parameters :
Id : 435
Description : The primary AD FS token signing certificate ( thumbprint %1 ) will expire at %2 UTC.
The certificate rollover service will roll over to the current secondary ( thumbprint %3 ) at %4 UTC.
Relying parties that rely on federation metadata will be notified automatically; any relying parties that do not rely on federation
metadata must be informed of the new certificate before the rollover at %4 UTC.
Parameters :
Id : 548
Description : The tenant certificate for Azure MFA will expire soon.
TenantId: %1.
Thumbprint: %2.
Expiration date: %3.
Parameters :
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
