# List all Exchange certificates with expiration status
Get-ExchangeCertificate | Select-Object Subject, Thumbprint, NotAfter, Services, Status | Format-Table -AutoSize

# Find expired certificates
Get-ExchangeCertificate | Where-Object { $_.NotAfter -lt (Get-Date) } | Format-List Subject, Thumbprint, NotAfter, Services

# Find certificates expiring soon (within 30 days)
Get-ExchangeCertificate | Where-Object {
    $_.NotAfter -lt (Get-Date).AddDays(30) -and
    $_.NotAfter -gt (Get-Date)
} | Format-List Subject, Thumbprint, NotAfter, Services

# Get detailed certificate information
$expiredCert = Get-ExchangeCertificate | Where-Object { $_.NotAfter -lt (Get-Date) }
$expiredCert | Format-List *

# Check services assigned to the certificate
Write-Host "Services using expired certificate:" -ForegroundColor Red
$expiredCert | ForEach-Object {
    Write-Host "Thumbprint: $($_.Thumbprint)"
    Write-Host "Services: $($_.Services)"
    Write-Host "Subject: $($_.Subject)"
}

# Check IIS bindings
Import-Module WebAdministration
Get-ChildItem IIS:\SslBindings | Format-Table *

# Check certificate chain status
$cert = Get-ExchangeCertificate | Where-Object { $_.Services -match "IIS" }
$certObj = Get-ChildItem "Cert:\LocalMachine\My\$($cert.Thumbprint)"

$chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
$chain.Build($certObj)

Write-Host "Chain Status:" -ForegroundColor Cyan
$chain.ChainStatus | Format-Table Status, StatusInformation

Write-Host "Chain Elements:" -ForegroundColor Cyan
$chain.ChainElements | ForEach-Object {
    Write-Host "  - $($_.Certificate.Subject)"
    Write-Host "    Expires: $($_.Certificate.NotAfter)"
}

# Test HTTPS connectivity to Exchange services
$urls = @(
    "https://$env:COMPUTERNAME/owa",
    "https://$env:COMPUTERNAME/ecp",
    "https://$env:COMPUTERNAME/ews/exchange.asmx",
    "https://$env:COMPUTERNAME/Microsoft-Server-ActiveSync"-Server-ActiveSync"
)

foreach ($url in $urls) {
    try {
        $response = Invoke-WebRequest -Uri $url -UseDefaultCredentials -ErrorAction Stop
        Write-Host "OK: $url" -ForegroundColor Green
    } catch {
        Write-Host "FAIL: $url - $($_.Exception.Message)"$_.Exception.Message)" -ForegroundColor Red
    }
}

# Test SMTP TLS
$smtpTest = Test-NetConnection -ComputerName $env:COMPUTERNAME -Port 25
Write-Host "SMTP Port 25: $(if($smtpTest.TcpTestSucceeded){'Open'}else{'Blocked'})"$smtpTest.TcpTestSucceeded){'Open'}else{'Blocked'})"

# Generate CSR for public CA
$domains = @(
    "mail.contoso.com",
    "autodiscover.contoso.com",
    "owa.contoso.com"
)

$csr = New-ExchangeCertificate -GenerateRequest -SubjectName "CN=mail.contoso.com, O=Contoso Corporation, L=Seattle, S=Washington, C=US" -DomainName $domains -PrivateKeyExportable $true -KeySize 2048 -FriendlyName "Exchange Certificate 2025"

# Save CSR to file for submission to CA
$csr | Out-File "C:\Temp\ExchangeCSR.txt"

Write-Host "CSR saved to C:\Temp\ExchangeCSR.txt"
Write-Host "Submit this CSR to your certificate authority"

# View the CSR
Get-Content "C:\Temp\ExchangeCSR.txt"

# After receiving certificate from CA, import it
$certPath = "C:\Temp\ExchangeCert.cer"  # Path to certificate file from CA

# Import the certificate (completes the request)
Import-ExchangeCertificate -FileData ([System.IO.File]::ReadAllBytes($certPath)) -FriendlyName "Exchange Certificate 2025"

# Find the new certificate
$newCert = Get-ExchangeCertificate | Where-Object { $_.FriendlyName -eq "Exchange Certificate 2025" }
Write-Host "Imported certificate: $($newCert.Thumbprint)"
Write-Host "Valid until: $($newCert.NotAfter)"

# If you have a PFX file instead (includes private key)
$pfxPath = "C:\Temp\ExchangeCert.pfx"
$pfxPassword = Read-Host "Enter PFX password" -AsSecureString
Import-ExchangeCertificate -FileData ([System.IO.File]::ReadAllBytes($pfxPath)) -Password $pfxPassword

# Get the new certificate thumbprint
$newCert = Get-ExchangeCertificate | Where-Object {
    $_.NotAfter -gt (Get-Date) -and
    $_.Subject -match "mail.contoso.com"
} | Sort-Object NotAfter -Descending | Select-Object -First 1

Write-Host "Assigning certificate: $($newCert.Thumbprint)"

# Enable certificate for Exchange services
Enable-ExchangeCertificate -Thumbprint $newCert.Thumbprint -Services IIS, SMTP, POP, IMAP -Force

# Verify assignment
Get-ExchangeCertificate -Thumbprint $newCert.Thumbprint | Format-List Subject, Thumbprint, Services, NotAfter

# Restart IIS to apply changes
iisreset /noforce

# Restart Transport for SMTP changes
Restart-Service MSExchangeTransport

# For hybrid environments, update OAuth certificate if needed
$oauthCert = Get-AuthConfig | Select-Object -ExpandProperty CurrentCertificateThumbprint

# If OAuth uses a separate certificate, update it
if ($oauthCert -ne $newCert.Thumbprint) {
    Write-Host "OAuth uses different certificate. Checking if it needs update..."
    $oauth = Get-ExchangeCertificate -Thumbprint $oauthCert
    if ($oauth.NotAfter -lt (Get-Date)) {
        Write-Host "OAuth certificate also expired. Updating..."
        Set-AuthConfig -NewCertificateThumbprint $newCert.Thumbprint -NewCertificateEffectiveDate (Get-Date)
        Set-AuthConfig -PublishCertificate
    }
}

# After verifying new certificate is working, remove expired ones
$expiredCerts = Get-ExchangeCertificate | Where-Object { $_.NotAfter -lt (Get-Date) }

foreach ($cert in $expiredCerts) {
    Write-Host "Removing expired certificate: $($cert.Subject)" -ForegroundColor Yellow
    Remove-ExchangeCertificate -Thumbprint $cert.Thumbprint -Confirm:$false
}

# Verify only valid certificates remain
Get-ExchangeCertificate | Format-Table Subject, Thumbprint, NotAfter, Services -AutoSize