Is there a tool that reports on PKI health (CRL dates, expiry, etc)?

Question

I'm looking for a tool that will walk the AIA tree from a leaf node and check all corresponding CRL dates and times.

Ideally it will also check versions and cross root trusts.

Does such a tool exist? If not, what is the closest I can get to that goal?

Answer 1

Just to add my one cent.

I'm not aware of any such ready tools, however this feature was requested by a customer of mine some time ago. Eventually, I ended up with my own PowerShell solution for Windows. Here are two blog posts where I describe the behavior:

• Enterprise PKI (pkiview.msc) PowerShell Edition (PoC)
• Enterprise PKI health verifier, PowerShell Edition v1.5

Although, postings refer to Microsoft ADCS, there is a -Certificate parameter where you can pass arbitrary certificate.

Generally, the script does the following:

1. Prepare input certificate;
2. Execute chain for each certificate to select trusted anchors and to go through the chain;
3. Retrieve all Issuer URLs from AIA;
4. Validate each url (must be either http or ldap) and attempt to download the contents;
5. If contents is downloaded, verify whether it is a certificate;
6. Verify if the downloaded certificate is an issuer of the certificate in subject;
7. Validate other cert properties;
8. Extract URLs from CDP extension;
9. Validate each url (must be either http or ldap) and attempt to download the contents;
10. If contents is downloaded, verify whether it is a CRL;
11. Validate basic CRL properties, like validity (not yet valid, expired, about to expire);
12. Validate whether the CRL has valid signature (against CA certificate);
13. Do the same for DeltaCRLs;
14. Extract all OCSP URLs from AIA extension;
15. Validate OCSP response by sending OCSP request and processing response;
16. Compose status report (managed, I maintain report object and you can access report properties);
17. Repeat steps 3-16 for each subsequent certificate in the chain up to root certificate;
18. Compose summary report.

Not all you've requested (cross-certificates are not verified), but enough for a good start.

Where to get the latest version of the script? It is a part of my PowerShell PKI module. Download sources of the most recent release: https://pspki.codeplex.com/releases

you will need only three files:

• Get-EnterprisePKIHealthStatus.ps1
• PKI.Core.dll
• SysadminsLV.Asn1Parser.dll

All files are digitally signed by me. If you concern about dlls, they are opensourced: PKIX.NET (PKI.Core.dll) and Asn1DerParser.NET (SysadminsLV.Asn1Parser.dll)

and the last, online help for PowerShell function: Get-EnterprisePKIHealthStatus.

HTH