For now the x509 certificate provide four modes (https, tcp, file and opensslcli), but Windows “MMC” certificates still can’t be check.
I propose to add this “custommode”.
Many of windows packaged plugins run powershell commands to retrieve informations and the perl side format the output to the standard centreon.
For retrieve the MMC certificates informations, we can run the flollowing powershell command :
Get-ChildItem -Path 'Cert:\LocalMachine\Remote Desktop' | Select *
PSPath : Microsoft.PowerShell.Security\Certificate::LocalMachine\Remote Desktop\57014B6168AD0DF7B10185FCD9D
ED51F7D470E17
PSParentPath : Microsoft.PowerShell.Security\Certificate::LocalMachine\Remote Desktop
PSChildName : 57014B6168AD0DF7B10185FCD9DED51F7D470E17
PSDrive : cert
PSProvider : Microsoft.PowerShell.Security\Certificate
PSIsContainer : False
Archived : False
Extensions : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid}
FriendlyName :
IssuerName : System.Security.Cryptography.X509Certificates.X500DistinguishedName
NotAfter : 28/11/2023 19:07:49
NotBefore : 29/05/2023 20:07:49
HasPrivateKey : True
PrivateKey : System.Security.Cryptography.RSACryptoServiceProvider
PublicKey : System.Security.Cryptography.X509Certificates.PublicKey
RawData : {48, 130, 2, 216...}
SerialNumber : 68588A4B2F8BF98B476714E087F0F16A
SubjectName : System.Security.Cryptography.X509Certificates.X500DistinguishedName
SignatureAlgorithm : System.Security.Cryptography.Oid
Thumbprint : 57014B6168AD0DF7B10185FCD9DED51F7D470E17
Version : 3
Handle : 451449296
Issuer : CN=VM-2008-R2
Subject : CN=VM-2008-R2The path “Cert:\LocalMachine\” contains the same folders like the MMC (with Snap-In “Certificates (Local Computer), For exemple, “My” folder in powershell matches with “Personnal” folder in MMC.
With the following command, we can display all the folders certificates
PS C:\Users\Administrateur> Get-ChildItem Cert:\LocalMachine\ | Select PSPath
PSPath
------
Microsoft.PowerShell.Security\Certificate::SmartCardRoot
Microsoft.PowerShell.Security\Certificate::AuthRoot
Microsoft.PowerShell.Security\Certificate::CA
Microsoft.PowerShell.Security\Certificate::Trust
Microsoft.PowerShell.Security\Certificate::Disallowed
Microsoft.PowerShell.Security\Certificate::My
Microsoft.PowerShell.Security\Certificate::Root
Microsoft.PowerShell.Security\Certificate::TrustedPeople
Microsoft.PowerShell.Security\Certificate::TrustedDevices
Microsoft.PowerShell.Security\Certificate::Remote Desktop
Microsoft.PowerShell.Security\Certificate::TrustedPublisherPlace a filtrer on these folders in the plugin will be very useful.
When we have a Certificate object listing, we can filter the property “Issuer” for target the correct one.
=> this would be the second filter.
Once the certificates parameters retreived, i think it’s easy to evaluate expiration date like others modes with same options (warning-status and critical-status).
What do you think about that ?
