Detent PointEach certificate surface reads differently — a registry value for the engine binding, WMI for Reporting Services, catalog views for TDE and cell-level, DMVs and endpoint metadata for the rest. Checking them means knowing all the places to look and querying each one its own way. Most estates don’t, so the first sign of an expired certificate is usually the outage it causes.
The certificate that bites is rarely the one you were watching. It’s the endpoint cert on a DR replica, or the backup-encryption cert nobody remembered was set, that quietly reaches its date.
get_sql_cert_inventory walks every certificate surface on an instance and returns one row per certificate, each with its expiry and a days-to-expiry flag against a threshold you set. Point it at a list of instances and it does the same across the estate, so the renewal shortlist — every certificate expiring within the next month or two, soonest first — is one sorted table.
A surface it can’t read comes back as its own row saying so, and an undated certificate reports its expiry as unknown rather than as fine — so a gap surfaces instead of hiding. It’s read-only and free, which makes it the natural first step before any renewal or migration work.
Every row is stamped with the module version, commit, run id, and timestamp, so the output stands as a record — export it to CSV for a change ticket, a compliance sweep, or just a baseline you re-run each quarter. Nothing in the pass changes a certificate; it reports where the estate stands so you can decide what to fix.