# Script to get details of all certificates on Windows devices

Organizations may need to check that only valid and trusted certificates are used on devices to ensure the proper functioning of the organization. These details can help admins to plan for certificate expirations and renewals. But reviewing every certificate is a tiresome task. Using Hexnode UEM’s [Execute Custom Script](https://www.hexnode.com/mobile-device-management/help/executing-custom-scripts-for-windows/) feature, you can remotely fetch certificates detail on Windows devices.

 Disclaimer:The sample scripts provided below are adapted from third-party open-source sites.

 

PowerShell script
-----------------

4. To display details of all certificates present in the Root directory of the local machine account, use the following script:
Script to get details of certificates in Root directory of the LocalMachine

Get-ChildItem Cert:\\LocalMachine\\Root\\

   1

  Get-ChildItem Cert:\\LocalMachine\\Root\\

   

 

  

6. To display the details of a specific certificate present in the Root store using its FriendlyName, use the following script:
Script to display details of a specific certificate present in the Root store

Get-ChildItem Cert:\\LocalMachine\\Root\\ | where{$\_.FriendlyName -eq 'FriendlyName'}

   1

  Get-ChildItem Cert:\\LocalMachine\\Root\\ | where{$\_.FriendlyName -eq 'FriendlyName'}

   

 

  

E.g., To get details of a certificate having the FriendlyName of “DigiCert” from the Root store.

`Get-ChildItem Cert:\LocalMachine\Root\ | where{$_.FriendlyName -eq 'DigiCert'}`

10. To display the details of a specific certificate present in all other certificate stores using the certificate’s FriendlyName, use the following script:
Script to display details of a specific certificate present in all other certificates store

Get-ChildItem Cert:\\LocalMachine\\ -Recurse | where{$\_.FriendlyName -eq 'FriendlyName'}

   1

  Get-ChildItem Cert:\\LocalMachine\\ -Recurse | where{$\_.FriendlyName -eq 'FriendlyName'}

   

 

  

E.g., To get details of a certificate having FriendlyName of “DigiCert” present in all other certificate stores.

`Get-ChildItem Cert:\LocalMachine\ -Recurse | where{$_.FriendlyName -eq 'DigiCert'}`

14. To display details of certificates present in CurrentUser, use the following script:
Script to get details of certificates in CurrentUser

Get-ChildItem Cert:\\ -Recurse

   1

  Get-ChildItem Cert:\\ -Recurse

   

 

  

16. To display the full details of a particular certificate, use the following script:
Script to display full details of a particular certificate

Get-ChildItem Cert:\\LocalMachine\\root | where{$\_.FriendlyName -eq 'FriendlyName'} | fl \*

   1

  Get-ChildItem Cert:\\LocalMachine\\root | where{$\_.FriendlyName -eq 'FriendlyName'} | fl \*

   

 

  

E.g., To get full details of the certificate with the FriendlyName of “DigiCert”.

`Get-ChildItem Cert:\LocalMachine\root | where{$_.FriendlyName -eq 'DigiCert'} | fl *`

20. To display details of a specific certificate present in certificate stores using its thumbprint, use the following script:
Script to get a certificate present in all certificate stores using its thumbprint

$thumbprint = '<thumbprint>' $stores = @('Cert:\\CurrentUser\\My', 'Cert:\\LocalMachine\\My') foreach ($store in $stores) { $cert = Get-ChildItem -Path $store | Where-Object {$\_.Thumbprint -eq $thumbprint} if ($cert) { Write-Host "Certificate found in $store" $cert } else { Write-Host "Certificate not found in $store" } } 

   1

2

3

4

5

6

7

8

9

10

11

  $thumbprint = '<thumbprint>'

$stores = @('Cert:\\CurrentUser\\My', 'Cert:\\LocalMachine\\My')

foreach ($store in $stores) {

 $cert = Get-ChildItem -Path $store | Where-Object {$\_.Thumbprint -eq $thumbprint}

 if ($cert) {

 Write-Host "Certificate found in $store"

 $cert

 } else {

 Write-Host "Certificate not found in $store"

 }

} 

   

 

  

E.g., To get details of a certificate having thumbprint of “4B789A3918C60107A19F629FCA3FEB4FE9CAD49A” present in all other certificate stores.

`$thumbprint = '4B789A3918C60107A19F629FCA3FEB4FE9CAD49A'`

`$stores = @('Cert:\CurrentUser\My', 'Cert:\LocalMachine\My')`

`foreach ($store in $stores) {`

`$cert = Get-ChildItem -Path $store | Where-Object {$_.Thumbprint -eq $thumbprint}`

`if ($cert) {`

`Write-Host "Certificate found in $store"`

`$cert`

`} else {`

`Write-Host "Certificate not found in $store"`

`}`

`}`

34. To display the certificates expiring in a number of days, use the following script:
Script to display the certificates expiring in a number of days

Get-ChildItem -Path Cert: -recurse -ExpiringInDays ‘Days’

   1

  Get-ChildItem -Path Cert: -recurse -ExpiringInDays ‘Days’

   

 

  

E.g., To get details of a certificates expiring in 30 days

`Get-ChildItem -Path Cert: -recurse -ExpiringInDays 30`

 Notes:- It is recommended to manually validate the script execution on a system before executing the action in bulk.
- Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.