FAQ - Chain Validation Testing Scenarios

Validate Chain Validation monitoring with automated PowerShell test scripts covering all detection scenarios - from untrusted roots and partial chains (ERROR) to revocation check failures (WARNING) and valid certificate chains (OK).

What's on This Page:

• 6 Test Scenarios - Automated PowerShell 7 scripts for UntrustedRoot, PartialChain, NotTimeValid, RevocationStatusUnknown, Dev Mode, and Complete Valid Chain
• Batch Testing Script - Create all test scenarios with configurable flags and error handling
• Cleanup Script - Remove test certificates after validation testing
• Validation Checklist - Verify expected monitoring states match actual results
• Troubleshooting - Resolve testing-specific issues (PowerShell errors, chain building)

Why Test Chain Validation?

Chain validation testing prevents certificate trust failures from causing production outages. Testing ensures monitoring correctly identifies:

• ❌ UntrustedRoot errors (ERROR) - Root CA not in trusted store causes application failures
• ❌ PartialChain errors (ERROR) - Missing intermediate certificates break trust validation
• ❌ NotTimeValid errors (ERROR) - Expired intermediates invalidate entire certificate chains
• ⚠️ RevocationStatusUnknown warnings (WARNING) - CRL/OCSP unreachable, potential security gap
• ✅ Valid chains (OK) - Complete, trusted certificate chains validate successfully

Related Documentation: See Chain Validation for complete feature documentation, detection examples, and remediation guidance.

Note

These scripts require PowerShell 7+ with Administrator privileges for certificate store access.

Warning

Never deploy test certificates to production environments. Always clean up after validation testing.

Chain validation showing inline error diagnostics with specific chain errors and remediation recommendations.

Testing Scenarios Overview

Test Scenario Workflow

Diagram: Chain validation test workflow showing scenario configuration, expected states, and monitoring verification process with color-coded severity levels.

Test Scenarios

Scenario 1: Untrusted Root Certificate

Purpose: Validate monitoring detection of self-signed certificates with root CA not in trusted store.

Configuration:

Expected Results:

Scenario 2: Partial Chain (Missing Intermediate)

Purpose: Validate detection of incomplete certificate chains with missing intermediate CA.

Configuration:

Expected Results:

Scenario 3: Expired Intermediate Certificate

Purpose: Validate detection of expired intermediate CA certificates breaking the chain.

Configuration:

Expected Results:

Scenario 4: Revocation Check Failure

Purpose: Validate WARNING state when CRL/OCSP endpoints are unreachable.

Configuration:

Expected Results:

Scenario 5: Valid Chain with Dev Mode

Purpose: Validate AllowSelfSignedCertificates configuration downgrades UntrustedRoot to WARNING.

Configuration:

Expected Results:

Scenario 6: Complete Valid Chain

Purpose: Validate monitoring correctly identifies healthy certificates with complete, trusted chains.

Configuration:

Expected Results:

Batch Testing Script

Purpose: Create all 5 test scenarios with a single PowerShell script.

# Chain Validation Testing - Batch Script
# Creates all 6 test scenarios for chain validation monitoring
#
# Requires: PowerShell 7+, Administrator privileges
# Usage: .\Test-ChainValidation.ps1 -Scenarios 1,2,3,4,5,6

param(
    [int[]]$Scenarios = @(1,2,3,4,5,6),  # Which scenarios to create
    [switch]$Verbose                      # Show detailed output
)

Write-Host "=" * 70 -ForegroundColor Cyan
Write-Host "Chain Validation Test Suite" -ForegroundColor Cyan
Write-Host "==" * 70 -ForegroundColor Cyan
Write-Host ""

# Scenario 1: UntrustedRoot
if (1 -in $Scenarios) {
    Write-Host "[1/5] Creating UntrustedRoot scenario..." -ForegroundColor Yellow
    $cert1 = New-SelfSignedCertificate `
        -Subject "CN=TestCert-UntrustedRoot, O=Nodinite Chain Testing" `
        -CertStoreLocation "Cert:\LocalMachine\My" `
        -KeyLength 2048 -NotAfter (Get-Date).AddDays(90)
    Write-Host "  ✓ Created: $($cert1.Thumbprint)" -ForegroundColor Green
}

# Scenario 2: PartialChain
if (2 -in $Scenarios) {
    Write-Host "[2/5] Creating PartialChain scenario..." -ForegroundColor Yellow
    $root2 = New-SelfSignedCertificate -Subject "CN=Test Root CA" -CertStoreLocation "Cert:\LocalMachine\My" -KeyUsage CertSign -NotAfter (Get-Date).AddDays(365)
    $int2 = New-SelfSignedCertificate -Subject "CN=Test Intermediate CA" -Signer $root2 -CertStoreLocation "Cert:\LocalMachine\My" -KeyUsage CertSign -NotAfter (Get-Date).AddDays(180)
    $cert2 = New-SelfSignedCertificate -Subject "CN=TestCert-PartialChain" -Signer $int2 -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter (Get-Date).AddDays(90)
    Remove-Item "Cert:\LocalMachine\My\$($int2.Thumbprint)" -Force  # Create partial chain
    Write-Host "  ✓ Created: $($cert2.Thumbprint) (intermediate removed)" -ForegroundColor Green
}

# Scenario 3: NotTimeValid (Expired Intermediate)
if (3 -in $Scenarios) {
    Write-Host "[3/5] Creating NotTimeValid scenario..." -ForegroundColor Yellow
    Write-Host "  ⚠ Note: Requires pre-created expired certificate or manual expiration" -ForegroundColor Yellow
    # This scenario typically requires importing an expired certificate
    # Or using certificate backdating tools not available in standard PowerShell
}

# Scenario 4: RevocationStatusUnknown
if (4 -in $Scenarios) {
    Write-Host "[4/5] Creating RevocationStatusUnknown scenario..." -ForegroundColor Yellow
    $cert4 = New-SelfSignedCertificate `
        -Subject "CN=TestCert-RevocationFailure, O=Nodinite Chain Testing" `
        -CertStoreLocation "Cert:\LocalMachine\My" `
        -KeyLength 2048 -NotAfter (Get-Date).AddDays(90) `
        -Extension @(
            [System.Security.Cryptography.X509Certificates.X509Extension]::new(
                "2.5.29.31",  # CRL Distribution Points
                [Convert]::FromBase64String("MGYwZKBioGCGXmh0dHA6Ly9pbnZhbGlkLXVybC1mb3ItdGVzdGluZy5leGFtcGxlL2NybA=="),
                $false
            )
        )
    Write-Host "  ✓ Created: $($cert4.Thumbprint)" -ForegroundColor Green
}

# Scenario 5: Dev Mode (Self-Signed with AllowSelfSignedCertificates)
if (5 -in $Scenarios) {
    Write-Host "[5/6] Creating Dev Mode scenario..." -ForegroundColor Yellow
    $cert5 = New-SelfSignedCertificate `
        -Subject "CN=TestCert-DevMode, O=Nodinite Chain Testing" `
        -CertStoreLocation "Cert:\LocalMachine\My" `
        -KeyLength 2048 -NotAfter (Get-Date).AddDays(90)
    Write-Host "  ✓ Created: $($cert5.Thumbprint)" -ForegroundColor Green
    Write-Host "  ⚠ Set AllowSelfSignedCertificates=true in agent config" -ForegroundColor Yellow
}

# Scenario 6: Complete Valid Chain
if (6 -in $Scenarios) {
    Write-Host "[6/6] Creating Complete Valid Chain scenario..." -ForegroundColor Yellow
    # Create root CA and install to Trusted Root store
    $root6 = New-SelfSignedCertificate -Subject "CN=Test Trusted Root CA" -CertStoreLocation "Cert:\LocalMachine\My" -KeyUsage CertSign -NotAfter (Get-Date).AddYears(5)
    $root6Path = "Cert:\LocalMachine\My\$($root6.Thumbprint)"
    Move-Item $root6Path "Cert:\LocalMachine\Root"  # Move to Trusted Root store
    
    # Create intermediate CA and install to Intermediate store
    $int6 = New-SelfSignedCertificate -Subject "CN=Test Trusted Intermediate CA" -Signer $root6 -CertStoreLocation "Cert:\LocalMachine\My" -KeyUsage CertSign -NotAfter (Get-Date).AddYears(2)
    $int6Path = "Cert:\LocalMachine\My\$($int6.Thumbprint)"
    Move-Item $int6Path "Cert:\LocalMachine\CA"  # Move to Intermediate store
    
    # Create end-entity certificate signed by intermediate
    $cert6 = New-SelfSignedCertificate -Subject "CN=TestCert-ValidChain" -Signer $int6 -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter (Get-Date).AddDays(365)
    Write-Host "  ✓ Created complete chain: $($cert6.Thumbprint)" -ForegroundColor Green
    Write-Host "  ✓ Root CA installed to Trusted Root store" -ForegroundColor Green
    Write-Host "  ✓ Intermediate CA installed to CA store" -ForegroundColor Green
}

Write-Host ""
Write-Host "=" * 70 -ForegroundColor Cyan
Write-Host "Test certificate creation complete!" -ForegroundColor Green
Write-Host "Next: Monitor results in Nodinite Web Client" -ForegroundColor Cyan
Write-Host "=" * 70 -ForegroundColor Cyan

Cleanup Script

Purpose: Remove all test certificates after validation testing.

# Chain Validation Cleanup Script
# Removes all test certificates created by the batch testing script
#
# Requires: PowerShell 7+, Administrator privileges
# Usage: .\Cleanup-ChainValidation.ps1

Write-Host "Removing Chain Validation test certificates..." -ForegroundColor Cyan

# Find and remove test certificates
$testCerts = Get-ChildItem Cert:\LocalMachine\My | Where-Object {
    $_.Subject -like "*Nodinite Chain Testing*" -or
    $_.Subject -like "CN=TestCert-*" -or
    $_.Subject -like "CN=Test Root CA*" -or
    $_.Subject -like "CN=Test Intermediate CA*"
}

if ($testCerts.Count -eq 0) {
    Write-Host "No test certificates found." -ForegroundColor Yellow
} else {
    Write-Host "Found $($testCerts.Count) test certificate(s)" -ForegroundColor White
    foreach ($cert in $testCerts) {
        Write-Host "  Removing: $($cert.Subject) [$($cert.Thumbprint)]" -ForegroundColor Gray
        Remove-Item "Cert:\LocalMachine\My\$($cert.Thumbprint)" -Force
    }
    Write-Host "✓ Cleanup complete!" -ForegroundColor Green
}

Chain Validation Verification

After creating test certificates, verify Nodinite monitoring detects chain errors correctly:

1. Wait for discovery - Allow 1-2 synchronization cycles (5-10 minutes default)
2. Check Web Client - Navigate to Windows Server certificate monitoring
3. Verify states - Confirm each test certificate shows expected state (Critical/Warning/OK)
4. Check inline errors - Expand chain validation to see specific error details
5. Test alerts - If enabled, verify alerts triggered for configured error types

Expected Timeline:

Frequently Asked Questions

Q: Why do I get script errors when running the PowerShell test scripts?
A: These scripts require PowerShell 7 or later with Administrator privileges. Verify your PowerShell version by running $PSVersionTable.PSVersion - it should show 7.x or higher. PowerShell 5.1 (Windows PowerShell) has limitations with certificate chain manipulation. Download PowerShell 7+ from Microsoft's official site. Additionally, certificate chain operations require Administrator rights to access Cert:\LocalMachine stores.

Q: How do I validate Certificate Chain Validation with Nodinite?
A: Run the Batch Testing Script (see section above) on your Windows Server to create test scenarios for UntrustedRoot, PartialChain, NotTimeValid, RevocationStatusUnknown, and Dev Mode configurations. The Nodinite monitoring agent will automatically discover these certificates during its next synchronization cycle and validate their chains according to configured policies. Review the monitoring results in the Nodinite Web Client to verify each certificate shows the expected chain validation state with inline error diagnostics.

Q: How do I enable Enhanced Chain Validation in Nodinite?
A: Enable the "Enhanced Chain Validation" feature in the Windows Server Monitoring Agent configuration. See the comprehensive Certificate Configuration guide for step-by-step instructions on enabling validation, configuring alert preferences for each error category (UntrustedRoot, PartialChain, RevocationStatusUnknown), setting AllowSelfSignedCertificates for dev/test environments, and adjusting cache duration for performance optimization.

Next Steps

Run Chain Validation Test Scripts - Execute batch testing scenarios
Verify Enhanced Chain Validation - Confirm expected error categorization
Clean Up Test Certificates - Remove test certificates after validation

Related Topics

Certificate Overview
Certificate Monitoring
Certificate Configuration
FAQ: Certificate Testing Scenarios
FAQ: Weak Cryptography Testing Scenarios
FAQ: Certificates for gMSA Accounts