[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12

$APIKey = "your_api_key_here"

$APIUrl = "https://your-status-page.example.com"

$HostDNSName = "ca-server.example.com"

$HostIP1 = "IP_Addr1"

$HostIP2 = "IP_Addr2"

$CRLBaseUrl = "/CertEnroll/Your_CA_Name.crl"

$DeltaCRLBaseUrl = "/CertEnroll/Your_CA_Name+.crl"

$AIABaseUrl = "/CertEnroll/Your_CA_Name.crt"

$TempDir = "C:\Kener-CAMonitor\Temp"

$OCSPRequestFile = "C:\Kener-CAMonitor\OCSP.req"

$LocalCACertPath = "C:\Kener-CAMonitor\CA.cer"

$RemoteAIAUrls = @(

"http://${HostDNSName}${AIABaseUrl}",

"http://${HostIP1}${AIABaseUrl}",

"http://${HostIP2}${AIABaseUrl}"

)

if (-not (Test-Path $TempDir)) {

New-Item -ItemType Directory -Path $TempDir -Force | Out-Null

}

function Get-UnixTimestamp {

[System.DateTimeOffset]::UtcNow.ToUnixTimeSeconds()

}

function Send-Status {

param(

[String]$Status

)

$headers = @{

"Authorization" = "Bearer $APIKey"

"Content-Type" = "application/json"

}

$body = @{

status = $Status

latency = 500

timestampInSeconds = Get-UnixTimestamp

tag = "CA"

} | ConvertTo-Json

try {

$response = Invoke-RestMethod -Uri "$APIUrl/api/status" -Method Post -Headers $headers -Body $body

Write-Host "Status updated successfully: $Status" -ForegroundColor Green

return $response

}

catch {

Write-Host "Failed to update status: $($_.Exception.Message)" -ForegroundColor Red

return $null

}

}

function Download-CRL {

try {

# Download Base CRL

Invoke-WebRequest -Uri "http://${HostDNSName}${CRLBaseUrl}" -OutFile "${TempDir}\CRL1.crl" -ErrorAction Stop

Invoke-WebRequest -Uri "http://${HostIP1}${CRLBaseUrl}" -OutFile "${TempDir}\CRL2.crl" -ErrorAction Stop

Invoke-WebRequest -Uri "http://${HostIP2}${CRLBaseUrl}" -OutFile "${TempDir}\CRL3.crl" -ErrorAction Stop

# Download Delta CRL

Invoke-WebRequest -Uri "http://${HostDNSName}${DeltaCRLBaseUrl}" -OutFile "${TempDir}\DeltaCRL1.crl" -ErrorAction Stop

Invoke-WebRequest -Uri "http://${HostIP1}${DeltaCRLBaseUrl}" -OutFile "${TempDir}\DeltaCRL2.crl" -ErrorAction Stop

Invoke-WebRequest -Uri "http://${HostIP2}${DeltaCRLBaseUrl}" -OutFile "${TempDir}\DeltaCRL3.crl" -ErrorAction Stop

return $true

}

catch {

Write-Host "Failed to download CRL: $($_.Exception.Message)" -ForegroundColor Red

return $false

}

}

function Test-Url {

try {

$downloadSuccess = Download-CRL

if (-not $downloadSuccess) {

return $false

}

# Check if all files were downloaded successfully

$files = @(

"${TempDir}\CRL1.crl",

"${TempDir}\CRL2.crl",

"${TempDir}\CRL3.crl",

"${TempDir}\DeltaCRL1.crl",

"${TempDir}\DeltaCRL2.crl",

"${TempDir}\DeltaCRL3.crl"

)

foreach ($file in $files) {

if (-not (Test-Path -Path $file -PathType Leaf)) {

Write-Host "File not found: $file" -ForegroundColor Red

return $false

}

}

return $true

}

catch {

Write-Host "URL test failed: $($_.Exception.Message)" -ForegroundColor Red

return $false

}

}

function Get-ExpirePeriod {

param(

[String]$CRLFile

)

try {

$File = Get-Item $CRLFile -ErrorAction Stop

# Use a more reliable method to parse the CRL file

$CertutilOutput = certutil -v $CRLFile | Out-String

# Debug: Output full certutil result (optional)

# Write-Host "certutil output: $CertutilOutput" -ForegroundColor Cyan

# Find the "Next Update:" line and extract the date

$NextUpdateDate = $null

# Directly search for the line containing "Next Update:"

$Lines = $CertutilOutput -split "`r?`n"

foreach ($Line in $Lines) {

if ($Line -match "Next Update:\s*(\d{4}/\d{1,2}/\d{1,2}\s+\d{1,2}:\d{2})") {

$DateString = $Matches[1]

# Try to parse the date format

if ($DateString -match "(\d{4})/(\d{1,2})/(\d{1,2})\s+(\d{1,2}):(\d{2})") {

$year = [int]$Matches[1]

$month = [int]$Matches[2]

$day = [int]$Matches[3]

$hour = [int]$Matches[4]

$minute = [int]$Matches[5]

$NextUpdateDate = Get-Date -Year $year -Month $month -Day $day -Hour $hour -Minute $minute -Second 0

break

}

}

}

if (-not $NextUpdateDate) {

Write-Host "Could not find 'Next Update:' information in CRL file: $CRLFile" -ForegroundColor Yellow

return [TimeSpan]::Zero

}

$CurrentDate = Get-Date

$timeLeft = $NextUpdateDate - $CurrentDate

Write-Host "CRL File: $CRLFile" -ForegroundColor DarkGray

Write-Host " Next Update: $($NextUpdateDate.ToString('yyyy-MM-dd HH:mm'))" -ForegroundColor DarkGray

Write-Host " Current Time: $($CurrentDate.ToString('yyyy-MM-dd HH:mm'))" -ForegroundColor DarkGray

Write-Host " Time Remaining: $([math]::Round($timeLeft.TotalHours, 2)) hours" -ForegroundColor DarkGray

# If the time has passed, return 0

if ($timeLeft.TotalSeconds -lt 0) {

return [TimeSpan]::Zero

}

return $timeLeft

}

catch {

Write-Host "Failed to parse CRL ($CRLFile): $($_.Exception.Message)" -ForegroundColor Red

return [TimeSpan]::Zero

}

}

function Test-CRL {

try {

# Get the minimum validity period among all CRLs

$CRLFiles = @(

"${TempDir}\CRL1.crl",

"${TempDir}\CRL2.crl",

"${TempDir}\CRL3.crl"

)

$DeltaCRLFiles = @(

"${TempDir}\DeltaCRL1.crl",

"${TempDir}\DeltaCRL2.crl",

"${TempDir}\DeltaCRL3.crl"

)

# Find the time closest to expiration among all CRLs

$CRLMinTimeLeft = $CRLFiles | ForEach-Object {

$timeLeft = Get-ExpirePeriod -CRLFile $_

if ($timeLeft -gt [TimeSpan]::Zero) {

$timeLeft

}

} | Sort-Object | Select-Object -First 1

if (-not $CRLMinTimeLeft) {

Write-Host "All base CRL files have expired" -ForegroundColor Red

return "DOWN"

}

# Find the time closest to expiration among all Delta CRLs

$DeltaCRLMinTimeLeft = $DeltaCRLFiles | ForEach-Object {

$timeLeft = Get-ExpirePeriod -CRLFile $_

if ($timeLeft -gt [TimeSpan]::Zero) {

$timeLeft

}

} | Sort-Object | Select-Object -First 1

if (-not $DeltaCRLMinTimeLeft) {

Write-Host "All delta CRL files have expired" -ForegroundColor Red

return "DOWN"

}

Write-Host "Base CRL Min Time Remaining: $([math]::Round($CRLMinTimeLeft.TotalHours, 2)) hours" -ForegroundColor Cyan

Write-Host "Delta CRL Min Time Remaining: $([math]::Round($DeltaCRLMinTimeLeft.TotalHours, 2)) hours" -ForegroundColor Cyan

# Set thresholds

$CRLWarnThreshold = [TimeSpan]::FromDays(2) # 2 days

$CRLDownThreshold = [TimeSpan]::FromHours(12) # 12 hours

$DeltaCRLWarnThreshold = [TimeSpan]::FromHours(4) # 4 hours

$DeltaCRLDownThreshold = [TimeSpan]::FromHours(2) # 2 hours

# Determine status

if ($CRLMinTimeLeft -ge $CRLWarnThreshold -and $DeltaCRLMinTimeLeft -ge $DeltaCRLWarnThreshold) {

return "UP"

}

elseif (($CRLMinTimeLeft -ge $CRLDegradedThreshold -and $CRLMinTimeLeft -lt $CRLWarnThreshold) -or

($DeltaCRLMinTimeLeft -ge $DeltaCRLDegradedThreshold -and $DeltaCRLMinTimeLeft -lt $DeltaCRLWarnThreshold)) {

return "DEGRADED"

}

else {

return "DOWN"

}

}

catch {

Write-Host "CRL test failed: $($_.Exception.Message)" -ForegroundColor Red

return "DOWN"

}

}

function Test-OCSP {

try {

# Ensure the OCSP request file exists

if (-not (Test-Path $OCSPRequestFile -PathType Leaf)) {

Write-Host "OCSP request file does not exist: $OCSPRequestFile" -ForegroundColor Red

return $false

}

# Test OCSP response for all endpoints

$Urls = @(

"http://${HostDNSName}/ocsp",

"http://${HostIP1}/ocsp",

"http://${HostIP2}/ocsp"

)

foreach ($Url in $Urls) {

try {

$response = Invoke-WebRequest -Uri $Url -Method Post -ContentType "application/ocsp-request" -InFile $OCSPRequestFile -ErrorAction Stop

if ($response.StatusCode -ne 200) {

Write-Host "OCSP response status code error ($Url): $($response.StatusCode)" -ForegroundColor Yellow

return $false

}

}

catch {

Write-Host "OCSP request failed ($Url): $($_.Exception.Message)" -ForegroundColor Red

return $false

}

}

return $true

}

catch {

Write-Host "OCSP test failed: $($_.Exception.Message)" -ForegroundColor Red

return $false

}

}

function Test-LocalCACertificate {

try {

# Check if the certificate file exists

if (-not (Test-Path $LocalCACertPath -PathType Leaf)) {

Write-Host "Local CA certificate not found: $LocalCACertPath" -ForegroundColor Red

return "DOWN"

}

# Load the certificate

$Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2

$Cert.Import($LocalCACertPath)

# Check certificate validity period

$CurrentDate = Get-Date

$DaysToExpire = ($Cert.NotAfter - $CurrentDate).Days

Write-Host "Local CA Certificate Check:" -ForegroundColor DarkCyan

Write-Host " Subject: $($Cert.Subject)" -ForegroundColor DarkGray

Write-Host " Issuer: $($Cert.Issuer)" -ForegroundColor DarkGray

Write-Host " Valid From: $($Cert.NotBefore.ToString('yyyy-MM-dd'))" -ForegroundColor DarkGray

Write-Host " Expires On: $($Cert.NotAfter.ToString('yyyy-MM-dd'))" -ForegroundColor DarkGray

Write-Host " Days Remaining: $DaysToExpire days" -ForegroundColor DarkGray

# Set thresholds

$CriticalThreshold = 14 # 14 days

$WarningThreshold = 30 # 30 days

# Determine status

if ($DaysToExpire -le 0) {

Write-Host "Local CA certificate has expired!" -ForegroundColor Red

return "DOWN"

}

elseif ($DaysToExpire -le $CriticalThreshold) {

Write-Host "Local CA certificate is about to expire (remaining $DaysToExpire days)" -ForegroundColor Red

return "DEGRADED"

}

elseif ($DaysToExpire -le $WarningThreshold) {

Write-Host "Local CA certificate will expire in $DaysToExpire days" -ForegroundColor Yellow

return "UP" # Warning but does not affect overall status

}

return "UP"

}

catch {

Write-Host "Local CA certificate check failed: $($_.Exception.Message)" -ForegroundColor Red

return "DOWN"

}

}

function Test-RemoteAIACertificates {

try {

$OverallStatus = "UP"

$CertCounter = 0

Write-Host "Remote AIA Certificate Check:" -ForegroundColor DarkCyan

foreach ($Url in $RemoteAIAUrls) {

$CertCounter++

$CertPath = "$TempDir\AIA_$CertCounter.crt"

try {

# Download certificate

Invoke-WebRequest -Uri $Url -OutFile $CertPath -ErrorAction Stop

# Check if the certificate file exists

if (-not (Test-Path $CertPath -PathType Leaf)) {

Write-Host " AIA certificate download failed: $Url" -ForegroundColor Red

$OverallStatus = "DOWN"

continue

}

# Load the certificate

$Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2

$Cert.Import($CertPath)

# Check certificate validity period

$CurrentDate = Get-Date

$DaysToExpire = ($Cert.NotAfter - $CurrentDate).Days

Write-Host " Certificate #$CertCounter ($Url):" -ForegroundColor DarkGray

Write-Host " Subject: $($Cert.Subject)" -ForegroundColor DarkGray

Write-Host " Issuer: $($Cert.Issuer)" -ForegroundColor DarkGray

Write-Host " Expires On: $($Cert.NotAfter.ToString('yyyy-MM-dd'))" -ForegroundColor DarkGray

Write-Host " Days Remaining: $DaysToExpire days" -ForegroundColor DarkGray

# Set thresholds

$CriticalThreshold = 30 # 30 days

$WarningThreshold = 90 # 90 days

# Determine status

if ($DaysToExpire -le 0) {

Write-Host " AIA certificate has expired!" -ForegroundColor Red

$OverallStatus = "DOWN"

}

elseif ($DaysToExpire -le $CriticalThreshold) {

Write-Host " AIA certificate is about to expire (remaining $DaysToExpire days)" -ForegroundColor Red

if ($OverallStatus -ne "DOWN") {

$OverallStatus = "DEGRADED"

}

}

elseif ($DaysToExpire -le $WarningThreshold) {

Write-Host " AIA certificate will expire in $DaysToExpire days" -ForegroundColor Yellow

# Warning but does not affect overall status

}

}

catch {

Write-Host " AIA certificate check failed ($Url): $($_.Exception.Message)" -ForegroundColor Red

$OverallStatus = "DOWN"

}

}

return $OverallStatus

}

catch {

Write-Host "Remote AIA certificate check failed: $($_.Exception.Message)" -ForegroundColor Red

return "DOWN"

}

}

try {

# Test URL and OCSP

$UrlTest = Test-Url

$ocspTest = Test-OCSP

if ($UrlTest -and $OCSPTest) {

$CRLResult = Test-CRL

$CACertResult = Test-LocalCACertificate

$AIAResult = Test-RemoteAIACertificates

# Comprehensive status assessment

Write-Host "`nComprehensive Status Assessment:" -ForegroundColor Magenta

Write-Host " CRL Status: $CRLResult" -ForegroundColor Cyan

Write-Host " CA Certificate Status: $CACertResult" -ForegroundColor Cyan

Write-Host " AIA Certificate Status: $AIAResult" -ForegroundColor Cyan

# Determine final status (take the most severe status)

$FinalStatus = "UP"

if ($CRLResult -eq "DOWN" -or $CACertResult -eq "DOWN" -or $AIAResult -eq "DOWN") {

$FinalStatus = "DOWN"

}

elseif ($CRLResult -eq "DEGRADED" -or $CACertResult -eq "DEGRADED" -or $AIAResult -eq "DEGRADED") {

$FinalStatus = "DEGRADED"

}

# Send final status

Send-Status -Status $FinalStatus

Write-Host "`nFinal Status: $FinalStatus" -ForegroundColor Green

}

else {

Send-Status -Status "DOWN"

Write-Host "URL or OCSP test failed, status set to DOWN" -ForegroundColor Red

}

}

catch {

Write-Host "Main program error: $($_.Exception.Message)" -ForegroundColor Red

Send-Status -Status "DOWN"

}

finally {

# Clean up temporary files

try {

Remove-Item "${TempDir}\*.crl" -Force -ErrorAction SilentlyContinue

Remove-Item "${TempDir}\AIA_*.crt" -Force -ErrorAction SilentlyContinue

}

catch {

Write-Host "Failed to clean up temporary files: $($_.Exception.Message)" -ForegroundColor Yellow

}

}