How to Query and Audit Digital Certificates in Windows 11 Using PowerShell

Digital X.509 certificates underpin fundamental security operations across Windows 11, including TLS/SSL encrypted web browsing, code-signing validation for executables and drivers, Virtual Private Network (VPN) mutual authentication, and encrypted email communications. Over time, enterprise endpoints accumulate dozens of certificates across user and machine stores. If rogue Root Certificate Authorities (CAs) are installed or legitimate administrative certificates expire silently, workstations can experience authentication outages or become vulnerable to man-in-the-middle (MitM) attacks.

While the graphical Microsoft Management Console snap-in (certmgr.msc) allows manual inspection of individual certificates, it does not support automated scanning, bulk filtering, or continuous compliance reporting. Windows PowerShell features a built-in Certificate Provider that mounts the Windows certificate hierarchy directly as a virtual filesystem drive (Cert:\). This tutorial explains how to query, filter, inspect, and audit digital certificates in Windows 11 using native PowerShell cmdlets.

---

Navigating the PowerShell Certificate Provider (Cert:\)

The Certificate Provider surfaces two primary certificate scopes within the Cert:\ drive namespace:

• Cert:\CurrentUser: Contains certificates, private keys, and trust stores belonging specifically to the logged-in user profile (such as personal S/MIME certificates and client authentication tokens).
• Cert:\LocalMachine: Contains system-wide certificates shared by all users and background services, including the Root (Trusted Root Certification Authorities), CA (Intermediate CAs), and My (Personal machine certificates used by IIS, RDP, or IPsec). Accessing private keys or system stores typically requires administrative privileges.

To inspect the available stores in PowerShell, open a PowerShell terminal (as Administrator) and run:

# List available certificate stores in the LocalMachine scope
Get-ChildItem -Path Cert:\LocalMachine

You will see standard containers such as AuthRoot, CA, My, Root, Remote Desktop, and TrustedPublisher.

---

How to Query Certificates in a Specific Store

To view all certificates installed in the computer’s Personal store (My), execute Get-ChildItem targeting that specific path:

# Query all machine certificates in the Personal store
Get-ChildItem -Path Cert:\LocalMachine\My | Select-Object -Property Subject, Thumbprint, NotAfter, HasPrivateKey | Format-Table -AutoSize

Each certificate object returns properties including its Distinguished Name (Subject), the cryptographic SHA-1 Thumbprint, the expiration timestamp (NotAfter), and a boolean indicating whether the associated private key is present (HasPrivateKey).

---

How to Audit and Find Expired or Soon-to-Expire Certificates

Unplanned certificate expiration is one of the leading causes of service outages. You can write a concise PowerShell pipeline to scan your certificate stores for certificates that are already expired or will expire within the next 30 days:

# Find all certificates in the Personal store expiring within 30 days
$thresholdDays = 30
$expirationDate = (Get-Date).AddDays($thresholdDays)

Get-ChildItem -Path Cert:\LocalMachine\My | 
    Where-Object { $_.NotAfter -le $expirationDate } | 
    Select-Object -Property Subject, Issuer, NotAfter, @{Name="Status"; Expression={
        if ($_.NotAfter -lt (Get-Date)) { "EXPIRED" } else { "Expiring Soon" }
    }} | 
    Format-Table -AutoSize

---

How to Search Certificates by Subject, Issuer, or Thumbprint

When auditing security baselines or validating that a specific corporate CA has deployed correctly, you can filter certificates using wildcard matches or exact thumbprints:

# Find certificates whose Subject contains a specific domain or keyword
Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*example.corp*" }

# Find certificates issued by a specific Certification Authority
Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object { $_.Issuer -like "*DigiCert*" }

# Retrieve a certificate using its exact 40-character SHA-1 Thumbprint
$thumbprint = "A1B2C3D4E5F6789012345678901234567890ABCD"
Get-Item -Path "Cert:\LocalMachine\My\$thumbprint"

---

How to Audit the Trusted Root Certification Authorities Store

Malware and adware frequently attempt to inject rogue root certificates into the Cert:\LocalMachine\Root store to intercept HTTPS traffic. To audit installed root certificates and verify that all roots belong to recognized public or corporate CAs:

# Export a clean list of all Trusted Root CAs to a CSV file for compliance auditing
Get-ChildItem -Path Cert:\LocalMachine\Root | 
    Select-Object -Property Subject, Issuer, NotBefore, NotAfter, Thumbprint | 
    Export-Csv -Path "$env:USERPROFILE\Desktop\Root_Certificates_Audit.csv" -NoTypeInformation

Write-Host "Certificate audit exported to Desktop." -ForegroundColor Green

---

How to Test Certificate Revocation and Chain Validity (Test-Certificate)

PowerShell provides the Test-Certificate cmdlet to verify whether a certificate builds a trusted chain up to an approved root and whether its status is valid according to Online Certificate Status Protocol (OCSP) or Certificate Revocation Lists (CRLs):

# Select a target certificate and validate its entire trust chain
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | Select-Object -First 1

# Test certificate validity
Test-Certificate -Cert $cert -AllowUntrustedRoot:$false

If the certificate is valid, unrevoked, and chains to a trusted root, PowerShell will return True. If any intermediate or root CA is missing or the certificate has been revoked, it returns False with relevant diagnostic error codes.

---

How to Remove an Unwanted or Untrusted Certificate

If your audit uncovers an unauthorised or corrupted certificate, you can remove it directly via PowerShell using Remove-Item:

# Specify the thumbprint of the rogue certificate
$badThumbprint = "0123456789ABCDEF0123456789ABCDEF01234567"

# Remove the certificate from the store
Remove-Item -Path "Cert:\LocalMachine\Root\$badThumbprint" -Confirm:$false
Write-Host "Target certificate successfully removed." -ForegroundColor Yellow