Detent PointDomain: Scheduled renewal (SQL / SSRS / PBIRS) · Risk: Read-only · Runs on: Windows, PowerShell 5.1 or 7
This answers “is this certificate about to be renewed, and when?” without touching anything. It’s the safe way to confirm a renewal job is set up correctly and to see how many days remain before the next renewal. Part of the free tier, so it costs nothing to check across an estate.
Reads the spec, reads the live certificate’s expiry (via the free Test-* commands), and runs the due-date gate — returning the decision (DueNow / NotDue / Unknown), days to expiry, and the reason. Makes no change; safe to run any time.
Recipe 01 — Would this job renew now?
Test-SqlCertRenewalJob -JobId sql01-engineReturns e.g. Decision=NotDue, DaysToExpiry=180 — set up correctly, nothing due yet.
Recipe 02 — Confirm a new job reads the right target
(Test-SqlCertRenewalJob -JobId reports-pbirs).Data | Format-List Decision, DaysToExpiry, ExpiresOnThis looks but never touches. It reads how close the certificate is to expiring and tells you whether a run would renew it right now — DueNow (yes), NotDue (not yet), or Unknown (it couldn’t read the expiry). Run it after setting up a job to confirm it points at the right certificate and sees a sensible number of days left.
| Question | Answer |
|---|---|
| Outbound calls? | None to the vendor. It reads your own certificate’s state. |
| What it changes | Nothing — read-only. |
| Licence | Free. Read-only preview needs no licence. |
| Dependency | Why | Required? |
|---|---|---|
| A registered renewal job | The spec it previews. | Yes |
| Read access to the target’s cert | To report the decision. | Yes |
- A non-mutating way to confirm renewal coverage and see days-to-expiry — ideal for a compliance check that certificates are on an active renewal schedule.
- Surfaces the same decision the runner would make, so “will this renew in time?” is answerable without waiting for the scheduled run.