Notification of an upcoming Internal SSL Certificate expiry in 2003 CA

A couple other methods I would recommend:
1) Outlook calendar notifications - when you install a cert, determine the expiration date and set a reminder accordingly.  Include servername, serial number of the cert, and any specific notes as applicable for a reminder.

2) Open the CA MMC and filter by expiration date for the upcoming month.  You can then export those to .csv file to use in excel.  You can also filter by template if you have a lot of autoenrollment stuff - to determine the template OID to search for (searching for the name usually doesn't work so well except in a few default templates) - open Certificate Templates MMC - open properties of the template - Extensions tab - select Certificate Template Information, then in the box below look for the big number after Object Identifier - you can highlight and ctl+c to copy (can't right click) and then paste that whole number for the certificate template name in the CA MMC - Issued Certificates filter.  Note that a few of the default tmepaltes won't have a number but an actual name, such as Basic EFS is "EFS".

Also note that for most autoenrollments they should go through pretty smooth, but DC certs will need to have the DC reboot after to start using it.  By default this will renew 6 weeks ahead of time for an annual cert - if your DC doesn't get rebooted at least monthly you might want to add Domain Controllers (if issued), Domain Controller Authentication, and Directory Email Replication templates to your filter.  If you reboot monthly anyways don't worry about it (e.g. after monthly patches).

Thanks for the posts so far.

Just a quick update, we do not have a Linux box on the network and the servers are restricted to the Internet so I cannot use the methods by Raj-GT.

The script from Paranormastic looks like what I need so I will try to get this implemented in a test environment this week and move it into our Production environment next week.  The other options are not reliable enough for my liking due to a higher risk of human error.

I'll let you know when I've updated the test and post for any help then :)

I managed to test the script and it doesn't quite do what I had hoped.

It can pull the data from the CA's Certificate, but not the issued Certificates which are the ones I'm needing to manage.

It also cannot obtain the certificate expiry date for the CA and returns an event id of 100 against source CA Operations. Error: Could not determine expiry dates for CRL for CA......

Close but not quite there.  I am going to have a look at the CAPICOM scripts as well to see if there is anything there.

This might also be of use...
http://www.diskmonitor.com/ism/SSL-Certificate-Monitor.aspx

were you running the script on the CA or on a server (or both)? the script should check what certs are in the local store - if you run on the CA then it will only check the CA's store, not the CA database.  this would be a script to run on all your servers that you use certs on.

Another possibility, albeit a bit more spendy, is to get a Certificate Management System (CMS).  There aren't too many out there - most are rebranded products from a couple core companies.  Microsoft ILM2 is one product you might look at - if you can find older versions of CLM that was the piece that did it, but is now part of ILM2.  Last I know ILM2 wasn't released yet but I think it was supposed to be out soon, I just haven't checked in a few months.  The beta was pretty solid though.  I think it was supposed to be about 15k though, so depending if you feel that is worth it or not...  Like I said, there aren't really any inexpensive ones that I know of... the development level is just way to high and takes years to develop.  But, they are very cool.

The script I offered would be similar to the product that Raj-GT suggested - only that has a GUI.  Looks okay for the price since it would come with other monitors too.  Again this would be distributed solution across all the cert using servers.

The CMS is a centralized server based solution - typically you request the cert (and smartcard if you use them) through the CMS using a workflow, then it tracks it for you and issues notifications, handles renewals, revocations, etc. in a nice pretty gui.