Use this PowerShell script to verify whether certificates in your store have a trusted root and a valid chain of trust. The script outputs certificate details to a CSV file, making it easy to identify which certificates are trusted.

Example output

<#
.SYNOPSIS
Validates the certificate chain for all certificates in specified stores.

.NOTES
  Author: Julian Dalley
  Version: 1.0
  Date: 2025-09-25
  Description: Uses .NET X509Chain to validate the certificate chain for each certificate.
#>

# Ensure script runs with elevated privileges
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs; exit 
}

# Function to validate certificate chain
function Test-CertificateChain {
    param (
        [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate
    )

    $chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
    $chain.ChainPolicy.RevocationMode = [System.Security.Cryptography.X509Certificates.X509RevocationMode]::Online
    $chain.ChainPolicy.RevocationFlag = [System.Security.Cryptography.X509Certificates.X509RevocationFlag]::EntireChain
    $chain.ChainPolicy.VerificationFlags = [System.Security.Cryptography.X509Certificates.X509VerificationFlags]::NoFlag

    $isValid = $chain.Build($Certificate)

    return [PSCustomObject]@{
        Subject         = $Certificate.Subject
        Issuer          = $Certificate.Issuer
        Thumbprint      = $Certificate.Thumbprint
        NotBefore       = $Certificate.NotBefore
        NotAfter        = $Certificate.NotAfter
        StoreLocation   = $Certificate.PSParentPath
        ChainIsValid    = $isValid
        ChainStatus     = ($chain.ChainStatus | ForEach-Object { $_.Status }) -join ', '
        ChainStatusInfo = ($chain.ChainStatus | ForEach-Object { $_.StatusInformation }) -join '; '
    }
}

# Certificate store paths
$storePaths = @(
    "cert:\CurrentUser\My",
    "cert:\LocalMachine\My",
    "cert:\CurrentUser\CA",
    "cert:\LocalMachine\CA"
)

# Collect and validate certificates
$results = foreach ($storePath in $storePaths) {
    try {
        Get-ChildItem -Path $storePath -ErrorAction Stop | ForEach-Object {
            Test-CertificateChain -Certificate $_
        }
    } catch {
        Write-Warning "Failed to access store: $storePath. Error: $_"
    }
}

# Export results to CSV
$timestamp = Get-Date -f yyyy-MM-dd-HH.mm.ss
$csvPath = "C:\Temp\CertificateChainValidation_$timestamp.csv"
$results | Export-Csv -Path $csvPath -NoTypeInformation
Write-Host "Certificate chain validation results exported to '$csvPath'."