Export of issued certificates from CA

Question

Hi guys, What is the best way (script) to pull out export (whole list or just a count) of all CAs issued certificates, same as that can be done with right-click on Issued Certs and export, from CA windows. Ive tried with certutil -view log to CSV file, but that exports issued, revoked, and failed requests together.

Answer 1

I have the same question as the OP and would just like to comment that asking "would you please tell us why you want to export them by using script?" tells me the person responding does not understand the purpose of automation. The reasons WHY they want to do that are irrelevant. The question was HOW.

I am trying to do the same task because management of certificate renewals is a nightmare. I have PowerShell code that remotely connects to my CA and does a dump. Then using the DNS Name we identify from our naming convention what group needs to manage the upgraded certificate and we send out an email alerting them of what they need to address. We don't want a person to have to click anything within the CA. The people responsible for the certificate renewals don't have access to the CA and we don't want the people that do to be tied down by what should be an automated process. All of this needs to be scheduled, we can't have unscheduled down time in production, so we cannot allow for auto renewal. Instead we have written script code in PowerShell that will perform the request, install it and then bind it within IIS, all without human intervention. We just schedule our jobs for the specific maintenance window approved for that application.

To the OP anonymous usersSkoko , I would recommend you do what I have done and run the following:

CertUtil -deleterow 04/01/2021 Cert
CertUtil -deleterow 04/01/2021 Request

The first will remove all Revoked and Expired Certificates. The second will remove all Failed Requests. The date you put will delete anything OLDER than the date given.
So there will at least be less extra and unneeded data exported. It would really be great if MS would release a comprehensive PowerShell module for the CA server software so we could be more granular. CertUtil SHOULD have the ability to specify what to export.

Answer 2

Hi Folks. Not sure if you've already resolved this. You can view the Certificate Authority store using the COM object called CertificateAuthority.View.
This gentleman has written out the powershell around it: https://www.sysadmins.lv/retired-msft-blogs/alejacma/how-to-export-issued-certificates-from-a-ca-programatically-powershell.aspx

Answer 3

Hello anonymous usersSkoko,

Thank you for posting here.

I have done a test in my lab.

I can export certificates in "Issued Certificates" containers by right clicking "Issued Certificates" and selecting "Export List".

Then I can see the contexts in the exported file as below.

I think this is what you want, but would you please tell us why you want to export them by using script?

And based on "I`ve tried with certutil -view log to CSV file, but that exports issued, revoked, and failed requests together.", what command have you tried?

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 4

Hello @Daisy Zhou ,
Sorry for the late reply.

Many thanks for support on this topic.

Kr,
Milos

Answer 5

The code exports binary certificates. No need for this (for me)
I just need a list with certificate subject, SAN & serial fields

Anybody has anything useful?
Script from here just errors out for me:

Exception calling "Substring" with "2" argument(s): "Length cannot be less than zero.
Parameter name: length"
At C:\PSScripts\getcerts.ps1:71 char:13
+             $CAs += $configString.SubString($configString.IndexOf("`` ...
+             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : ArgumentOutOfRangeException