CertScope 1.0.0
Watch TLS certificates and catch them before they expire.

CertScope is a standalone Windows 10/11 64-bit program. Copy CertScope.exe
anywhere and double-click it. There is nothing to install and no separate
runtime to download.

WHAT IT CHECKS
Add a host, host:port, or URL. Port 443 is assumed. Paste a list, or import
a .txt or .csv file. The same host and port is kept once.

  Port                         Connection
  443, 636, 993, 995, 8443     Direct TLS (and any other port you type)
  25, 587                      SMTP STARTTLS
  143                          IMAP STARTTLS
  110                          POP3 STLS
  3389                         RDP negotiation, then TLS

Check all runs the endpoints in parallel, with a progress bar and Cancel.
The grid shows host, port, status, days left, expiry, subject CN, issuer,
chain validity, hostname match, and the error reason. SANs, key, signature
algorithm, TLS version, and the last check time sit further right. Click a
column heading to sort. A cell that does not fit shows its full text as a
tooltip.

Status colors
  OK         Chain and hostname are acceptable, and expiry is outside the
             warning window.
  Expiring   Inside the warning window (default 30 days) and outside the
             critical window. Amber.
  Critical   Inside the critical window (default 7 days). Red on orange,
             separate from Expiring.
  Expired    The leaf, or a certificate in the chain, is past its end date.
  Error      The endpoint could not be checked. The Error column shows why.

Under the grid, the chain lists each certificate by role and common name
(Leaf, Intermediate, Root). The property grid shows subject, issuer, valid
from, valid to, days left, SANs, key, signature, SHA-1, SHA-256, and TLS
version. Problems are written in plain language: self-signed, untrusted
root, name mismatch, expired intermediate, and the other chain failures
Windows reports. Export the selected certificate as .cer (DER) or .pem, or
copy the details.

Certificate stores lists LocalMachine and CurrentUser certificates from My,
WebHosting, Remote Desktop, Root, and CA, with expiry and days left. Use
"Expiring or expired only" to filter. LocalMachine may be empty when the
account cannot read that store.

Settings changes the warning window, the critical window, the per-endpoint
timeout, and how many checks run at once. Those values are saved for the
next time you open CertScope.

Save and load the endpoint list as text or CSV. Export the grid to CSV or
an HTML report.

COMMAND LINE
Use this with Task Scheduler when a job should fail if a certificate is
getting old.

  CertScope.exe --check C:\Tools\endpoints.txt --csv C:\Tools\reports\certs.csv --warn 30 --critical 7

Exit codes
  0   Every endpoint is OK.
  1   At least one certificate is expiring or expired.
  2   The arguments or an input or output file are invalid.
  3   At least one endpoint could not be checked, and none are expiring
      or expired.

CertScope.exe --help prints the full option list. --html writes the same
report the desktop app exports. The command line does not read the settings
file; pass --warn and --critical on the command.

Example list (endpoints.txt):

  # one host, host:port, or URL per line
  portal.example.com
  mail.example.com:587
  ldaps://dc1.example.com
  rdp.example.com:3389

A CSV may use host,port or host,port,mode. Modes are tls, smtp, imap, pop3,
and rdp.

TASK SCHEDULER
  1. Create a task. Run it whether or not you are logged on if that account
     can reach the endpoints.
  2. Program:   C:\Tools\CertScope.exe
  3. Arguments: --check C:\Tools\endpoints.txt --csv C:\Tools\reports\certs.csv --warn 30 --critical 7
  4. Start in:  C:\Tools
  5. Alert when the last result is not 0.

LIMITATIONS
  - Revocation (CRL and OCSP) is not checked. A chain can look valid while
    a certificate is revoked.
  - Trust uses the Windows certificate store on the computer running the
    check. A missing root is reported as untrusted.
  - STARTTLS and RDP cover the common handshake. A server that demands a
    client certificate, or that speaks a nonstandard banner, is reported
    as an error.
  - The certificate store tab reads the stores Windows exposes to this
    process. It does not inventory other machines.
  - CertScope does not renew certificates or send mail. The exit code is
    the hook for a scheduler or monitoring job.
