# Get current OAuth configuration
Get-AuthConfig | Format-List *Certificate*

# View certificate details
$authConfig = Get-AuthConfig
$thumbprint = $authConfig.CurrentCertificateThumbprint
Get-ExchangeCertificate -Thumbprint $thumbprint | Format-List Subject, NotBefore, NotAfter, Status

# Check certificate expiration status
$cert = Get-ExchangeCertificate -Thumbprint $thumbprint
$daysUntilExpiry = ($cert.NotAfter - (Get-Date)).Days
Write-Host "Certificate expires in $daysUntilExpiry days" -ForegroundColor $(if($daysUntilExpiry -lt 30){"Red"}else{"Green"})

# Search for OAuth-related events
Get-WinEvent -FilterHashtable @{
    LogName = 'Application'
    ProviderName = 'MSExchange OAuth'
    Level = 2  # Error
    StartTime = (Get-Date).AddDays(-7)
} | Select-Object TimeCreated, Id, Message | Format-Table -Wrap

# Check for certificate-specific errors
Get-WinEvent -FilterHashtable @{
    LogName = 'Application'
    Id = 1003
    StartTime = (Get-Date).AddDays(-7)
} -ErrorAction SilentlyContinue | Format-List TimeCreated, Message

# Test OAuth authentication endpoint
$oauthEndpoint = "https://$(hostname)/ews/exchange.asmx"
try {
    $response = Invoke-WebRequest -Uri $oauthEndpoint -UseDefaultCredentials -ErrorAction Stop
    Write-Host "EWS endpoint accessible" -ForegroundColor Green
} catch {
    Write-Host "EWS authentication failed: $($_.Exception.Message)" -ForegroundColor Red
}

# Check OAuth metadata endpoint
$metadataUrl = "https://$(hostname)/autodiscover/metadata/json/1"
try {
    $metadata = Invoke-RestMethod -Uri $metadataUrl -ErrorAction Stop
    Write-Host "OAuth metadata endpoint accessible" -ForegroundColor Green
} catch {
    Write-Host "OAuth metadata error: $($_.Exception.Message)" -ForegroundColor Red
}

# Check certificate in Windows certificate store
$thumbprint = (Get-AuthConfig).CurrentCertificateThumbprint
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.Thumbprint -eq $thumbprint}

if ($cert) {
    Write-Host "Certificate found in store" -ForegroundColor Green
    Write-Host "Has Private Key: $($cert.HasPrivateKey)"
    Write-Host "Expiration: $($cert.NotAfter)"

    # Check if certificate is expired
    if ($cert.NotAfter -lt (Get-Date)) {
        Write-Host "WARNING: Certificate is EXPIRED!" -ForegroundColor Red
    }
} else {
    Write-Host "Certificate NOT found in Local Machine store!" -ForegroundColor Red
}

# Check private key permissions
$certPath = "Cert:\LocalMachine\My\$thumbprint"
$cert = Get-Item $certPath
$keyPath = $cert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName
Write-Host "Private Key Container: $keyPath"

# Create certificate with custom validity period (e.g., 10 years)
$startDate = Get-Date
$endDate = $startDate.AddYears(10)

$newCert = New-ExchangeCertificate -KeySize 2048 -PrivateKeyExportable $true -SubjectName "cn=Microsoft Exchange Server Auth Certificate" -FriendlyName "Microsoft Exchange Server Auth Certificate - Renewed $(Get-Date -Format 'yyyy-MM-dd')"-Format 'yyyy-MM-dd')" -DomainName @() -NotBefore $startDate -NotAfter $endDate

Write-Host "New Certificate Created:" -ForegroundColor Green
Write-Host "Thumbprint: $($newCert.Thumbprint)"
Write-Host "Valid From: $($newCert.NotBefore)"
Write-Host "Valid To: $($newCert.NotAfter)"

# Set the new certificate with a future effective date (allows graceful transition)
$effectiveDate = (Get-Date).AddHours(1)  # Certificate becomes active in 1 hour

Set-AuthConfig -NewCertificateThumbprint $newCert.Thumbprint -NewCertificateEffectiveDate $effectiveDate

# Verify configuration before publishing
Get-AuthConfig | Format-List CurrentCertificateThumbprint, NewCertificateThumbprint, NewCertificateEffectiveDate

Write-Host "New certificate configured. Will become active at: $effectiveDate" -ForegroundColor Yellow

# Publish the new certificate to make it active
Set-AuthConfig -PublishCertificate

# Verify the certificate is now current
$authConfig = Get-AuthConfig
Write-Host "Current Certificate Thumbprint: $($authConfig.CurrentCertificateThumbprint)"

# Restart services to pick up new certificate
Restart-Service MSExchangeOWAAppPool -Force
Restart-Service MSExchangeECPAppPool -Force
iisreset /noforce

Write-Host "Certificate published and services restarted" -ForegroundColor Green

# Connect to Exchange Online
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName admin@contoso.onmicrosoft.com

# Update the OAuth configuration in Exchange Online
# This refreshes the federation trust with the new certificate
Set-OrganizationRelationship -Identity "On-Premises to O365 - <GUID>" -Enabled $true

# Alternatively, run the Hybrid Configuration Wizard again
# This ensures all certificates and metadata are properly synchronized

# Test hybrid connectivity
Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com/ews/exchange.asmx -Mailbox admin@contoso.com

# Disconnect from Exchange Online
Disconnect-ExchangeOnline -Confirm:$false

# After verifying everything works, clear the old certificate reference
# Wait at least 24-48 hours before this step to ensure all cached tokens expire-48 hours before this step to ensure all cached tokens expire

Set-AuthConfig -ClearPreviousCertificate

# Verify final configuration
Get-AuthConfig | Format-List *Certificate*, State

# Optionally remove the expired certificate from the store
# Get the old thumbprint first
$oldThumbprint = "YOUR_OLD_THUMBPRINT"
Remove-ExchangeCertificate -Thumbprint $oldThumbprint -Confirm:$false