About this article
This article was created using an automated generation workflow utilizing generative AI. It is organized as a tip for checking HTTPS certificate expiration in PowerShell by verifying the .NET SslStream and X509Certificate2 specifications.

Verification Status: 📘 Official API Confirmed · PowerShell Sample Implemented · Physical Device Unverified

Checking HTTPS Certificate Expiration with PowerShell — Directly Using .NET SslStream

You can connect to an HTTPS site via TLS and retrieve the server certificate from PowerShell without having to open the certificate screen in a browser. Instead of PowerShell-specific cmdlets, you use .NET TcpClient and SslStream.

Minimal Sample

$hostName = "example.com"

# TcpClient is a .NET class responsible for TCP connections.


# Here, we are not using TLS yet, but first connecting to port 443.

$tcp = New-Object System.Net.Sockets.TcpClient
$ssl = $null

try {
    $tcp.Connect($hostName, 443)

    # By layering SslStream on top of TCP, TLS communication begins from here.

    $ssl = New-Object System.Net.Security.SslStream($tcp.GetStream(), $false)

    # Performs the TLS handshake and also verifies the certificate name and trustworthiness.

    $ssl.AuthenticateAsClient($hostName)

    # Converts the certificate presented by the destination into an easy-to-use X509Certificate2.

    $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($ssl.RemoteCertificate)

    # Calculates the remaining days by subtracting the current time from the certificate's expiration date (NotAfter).

    $days = [math]::Floor(($cert.NotAfter.ToUniversalTime() - [DateTime]::UtcNow).TotalDays)

    $cert | Select-Object Subject, Issuer, NotBefore, NotAfter, Thumbprint
    "DaysRemaining = $days"
}
finally {

    # Ensures the TLS/TCP connection is closed even if an error occurs midway.

    if ($ssl) { $ssl.Dispose() }
    $tcp.Close()
}

Perform TLS client-side authentication with AuthenticateAsClient, and then read RemoteCertificate as an X509Certificate2.

Avoiding Disabling Certificate Validation Intentionally

There are examples on the web that “always return true in a callback to retrieve the certificate,” but that would allow invalid certificates despite being a certificate expiration checking tool.

This sample uses default validation and errors out if TLS authentication fails. In failure investigation, the very fact that “connection could not be established” is important.

Calculating Remaining Days

NotAfter is the certificate’s expiration date. By taking the difference from the current time, you can expand this into a monitoring script.

For example, you can add logic to warn if there are less than 30 days remaining, or flag as critical if less than 7 days.

flowchart LR
    A[TCP 443接続] --> B[SslStream]
    B --> C[TLS認証]
    C --> D[RemoteCertificate]
    D --> E[NotAfterを確認]

GitHub Sample

• Checking TLS Certificate Expiration with PowerShell

Official Information & Primary Sources

• SslStream.AuthenticateAsClient – Microsoft Learn

• X509Certificate2 Class – Microsoft Learn