I'm looking for a tool that will walk the AIA tree from a leaf node and check all corresponding CRL dates and times.

Ideally it will also check versions and cross root trusts.

Does such a tool exist? If not, what is the closest I can get to that goal?

  • Operating system?
    – Crypt32
    Jan 18, 2017 at 17:07
  • @Crypt32 Windows, OSX, but I suppose I can spin up a VM to run this if needed. Jan 18, 2017 at 17:25

1 Answer 1


Just to add my one cent.

I'm not aware of any such ready tools, however this feature was requested by a customer of mine some time ago. Eventually, I ended up with my own PowerShell solution for Windows. Here are two blog posts where I describe the behavior:

Although, postings refer to Microsoft ADCS, there is a -Certificate parameter where you can pass arbitrary certificate.

Generally, the script does the following:

  1. Prepare input certificate;
  2. Execute chain for each certificate to select trusted anchors and to go through the chain;
  3. Retrieve all Issuer URLs from AIA;
  4. Validate each url (must be either http or ldap) and attempt to download the contents;
  5. If contents is downloaded, verify whether it is a certificate;
  6. Verify if the downloaded certificate is an issuer of the certificate in subject;
  7. Validate other cert properties;
  8. Extract URLs from CDP extension;
  9. Validate each url (must be either http or ldap) and attempt to download the contents;
  10. If contents is downloaded, verify whether it is a CRL;
  11. Validate basic CRL properties, like validity (not yet valid, expired, about to expire);
  12. Validate whether the CRL has valid signature (against CA certificate);
  13. Do the same for DeltaCRLs;
  14. Extract all OCSP URLs from AIA extension;
  15. Validate OCSP response by sending OCSP request and processing response;
  16. Compose status report (managed, I maintain report object and you can access report properties);
  17. Repeat steps 3-16 for each subsequent certificate in the chain up to root certificate;
  18. Compose summary report.

Not all you've requested (cross-certificates are not verified), but enough for a good start.

Where to get the latest version of the script? It is a part of my PowerShell PKI module. Download sources of the most recent release: https://pspki.codeplex.com/releases

you will need only three files:

  • Get-EnterprisePKIHealthStatus.ps1
  • PKI.Core.dll
  • SysadminsLV.Asn1Parser.dll

All files are digitally signed by me. If you concern about dlls, they are opensourced: PKIX.NET (PKI.Core.dll) and Asn1DerParser.NET (SysadminsLV.Asn1Parser.dll)

and the last, online help for PowerShell function: Get-EnterprisePKIHealthStatus.


  • 2
    "Just to add my one cent" Don't be so modest, that was a top percentile answer. You provide code you wrote yourself to handle an issue related to usability of crypto, explain the workings in natural language , and provide the code in a verfiably secure manner. I wish i could upvote more.
    – J.A.K.
    Jan 18, 2017 at 18:23
  • Note: "PSPKI" is the PowerShell version of Microsoft's graphical tool pkiview.msc. Which is a bit hidden, but still exists in Win2010R2. Jan 19, 2017 at 7:23
  • @StackzOfZtuff it is incorrect. PSPKI is PowerShell module for PKI/ADCS task automation. PowerShell version of Microsoft's PKIView.msc is just a functionality provided by a module. Entire module offers a ton of other features.
    – Crypt32
    Jan 19, 2017 at 10:08
  • I stand corrected! Jan 26, 2017 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.