Find machine certificates expiring within a number of days
Build a paste-ready command, then review its compatibility and effects before running it.
Get-ChildItem Cert:\LocalMachine\My | Where-Object NotAfter -lt (Get-Date).AddDays(<days>) | Sort-Object NotAfter | Select-Object Subject,Thumbprint,NotAfter,HasPrivateKeyComplete required fields to copy the generated command.
cautionrequires privileges Compatibility
WindowsVerified for Windows using powershell syntax.
Operational knowledgereview due 2027-01-19
RequirementsGet-ChildItemGet-ChildItem must be installed and available on PATH.Elevated accessReview the exact scope before using an elevated account.
Version supportGet-ChildItem Current supported releasesVerified for windows using powershell syntax; consult compatibility notes for platform-specific differences.
Expected signalsSubject Thumbprint NotAfter HasPrivateKeyRepresentative successful output; values vary with the selected target and system state.
Known errorsGet-ChildItem: command not foundGet-ChildItem is missing or is not available on PATH.Permission deniedThe current identity does not have the required access.
VerifyGet-ChildItem Cert:\LocalMachine\My | Where-Object NotAfter -lt (Get-Date).AddDays({{days}}) | Sort-Object NotAfter | Select-Object Subject,Thumbprint,NotAfter,HasPrivateKeyRe-run the corresponding read-only inspection and confirm the intended state.Rollback noteNo universal automatic rollback is available. Capture the current state and use the tool-specific recovery procedure before applying changes.
Command breakdown
01Get-ChildItemCommandRuns the Get-ChildItem stage of this one-liner.
02Cert:\LocalMachine\MyArgumentPasses Cert:\LocalMachine\My to Get-ChildItem.
03|PipelinePasses the output on the left to the command on the right.
04Where-ObjectCommandRuns the Where-Object stage of this one-liner.
05NotAfterArgumentPasses NotAfter to Where-Object.
06-ltOptionConfigures Where-Object with the -lt option.
07(Get-Date).AddDays(<days>)ParameterA value supplied in the Fill parameters section.
08|PipelinePasses the output on the left to the command on the right.
09Sort-ObjectCommandRuns the Sort-Object stage of this one-liner.
10NotAfterArgumentPasses NotAfter to Sort-Object.
11|PipelinePasses the output on the left to the command on the right.
12Select-ObjectCommandRuns the Select-Object stage of this one-liner.
13Subject,Thumbprint,NotAfter,HasPrivateKeyArgumentPasses Subject,Thumbprint,NotAfter,HasPrivateKey to Select-Object.
This advanced community-curated one-liner combines several stages. Review every option and placeholder before running it.
Example input
Get-ChildItem Cert:\LocalMachine\My | Where-Object NotAfter -lt (Get-Date).AddDays(30) | Sort-Object NotAfter | Select-Object Subject,Thumbprint,NotAfter,HasPrivateKey
Example output
Subject Thumbprint NotAfter HasPrivateKey
------- ---------- -------- -------------
CN=api.internal 4B9F2D0A7E3C1A0E7B6C29F5AD34862E9F17A322 8/2/2026 11:59:59 PM True
CN=legacy.local 09A6C3185F2F4C3C1D47F529F81A1FC2C028D614 8/14/2026 4:00:00 PM False
Illustrative output — exact values vary by system and data.
Official sources