Browse Windows certificate stores with PowerShell (Cert: drive)
Treat the Windows certificate store like a filesystem: list certificates, sort by expiry, and find the ones about to lapse.
01Command
$ Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, NotAfter, Thumbprint02What it does
PowerShell exposes certificate stores as a drive: Cert:\CurrentUser\My, Cert:\LocalMachine\Root, and friends behave like folders, so the usual Get-ChildItem / Where-Object pipeline works. The killer use is expiry monitoring: `... | Where-Object NotAfter -lt (Get-Date).AddDays(30)` finds certificates that will expire within a month. Each object also carries Thumbprint, which you need for renewal or removal commands.
03Risk
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- Get-PfxCertificate | Microsoft LearnEvidence: Microsoft documents the Certificate provider and Cert: drive, letting PowerShell navigate certificate stores and read certificate objects such as NotAfter.
- Get-ChildItem | Microsoft LearnEvidence: Microsoft documents Get-ChildItem as the cmdlet for enumerating items at any provider path, including the Cert: certificate store drive.
Last verified: 2026-09-17 · Category: Security & Privacy
06Related solutions
Read the Authenticode signature status and signer of any executable or script in PowerShell.
Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.
Search inside text files and logs with regex, returning file, line number and match.