Home › Guides › How to check an SSL certificate on Windows (PowerShell & command line)

How to check an SSL certificate on Windows (PowerShell & command line)

Check SSL certificate expiry and TLS version on Windows using PowerShell, certutil and the certificate store.

Remote website certificate (PowerShell)

$c=[Net.Sockets.TcpClient]::new('example.com',443)
$s=[Net.Security.SslStream]::new($c.GetStream(),$false,{$true})
$s.AuthenticateAsClient('example.com')
$s.RemoteCertificate | % { [Security.Cryptography.X509Certificates.X509Certificate2]$_ } | fl Subject,Issuer,NotAfter
$s.SslProtocol

NotAfter is the expiry date and SslProtocol is the negotiated TLS version.

Certificates installed on the machine

Get-ChildItem Cert:\LocalMachine\My | Select Subject,NotAfter,Thumbprint

IIS bindings

Get-ChildItem IIS:\SslBindings

certutil

certutil -dump cert.cer

Or skip the commands: paste the domain into our SSL checker.