Event ID 36874: Certificate Trust Chain Error

# Get Schannel certificate errors
Get-WinEvent -FilterHashtable @{
    LogName='System'
    ProviderName='Schannel'
    ID=36874,36888,36887
} -MaxEvents 50 | Format-List TimeCreated, Message

# Check for additional certificate errors
Get-WinEvent -FilterHashtable @{
    LogName='System'
    Level=2  # Error
} -MaxEvents 100 | Where-Object {
    $_.Message -like "*certificate*" -or
    $_.Message -like "*trust*" -or
    $_.Message -like "*chain*"
} | Format-Table TimeCreated, Id, Message -Wrap

# Get Exchange certificates and their chain status
Get-ExchangeCertificate | ForEach-Object {
    $cert = $_
    $chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
    $chain.ChainPolicy.RevocationMode = "Online"
    $chain.ChainPolicy.RevocationFlag = "EntireChain"

    $chainBuilt = $chain.Build($cert)

    [PSCustomObject]@{
        Thumbprint = $cert.Thumbprint
        Subject = $cert.Subject
        NotAfter = $cert.NotAfter
        ChainValid = $chainBuilt
        ChainStatus = ($chain.ChainStatus | ForEach-Object { $_.StatusInformation }) -join "; "
        ChainLength = $chain.ChainElements.Count
    }
} | Format-List

# Detailed chain element inspection
$cert = Get-ExchangeCertificate | Where-Object { $_.Services -match 'IIS' }
$chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
$chain.Build($cert) | Out-Null

Write-Host "Certificate Chain Elements:" -ForegroundColor Cyan
for ($i = 0; $i -lt $chain.ChainElements.Count; $i++) {
    $element = $chain.ChainElements[$i]
    Write-Host "`n[$i] $($element.Certificate.Subject)"$element.Certificate.Subject)" -ForegroundColor Yellow
    Write-Host "    Issuer: $($element.Certificate.Issuer)"
    Write-Host "    Valid: $($element.Certificate.NotBefore) to $($element.Certificate.NotAfter)"$element.Certificate.NotAfter)"
    Write-Host "    Thumbprint: $($element.Certificate.Thumbprint)"
}

# Using OpenSSL (if installed) to check certificate chain
# Install OpenSSL or use from Git installation
$opensslPath = "C:\Program Files\Git\usr\bin\openssl.exe"

# Test HTTPS connection
& $opensslPath s_client -connect mail.contoso.com:443 -showcerts 2>&1

# Test SMTP with STARTTLS
& $opensslPath s_client -connect mail.contoso.com:25 -starttls smtp -showcerts 2>&1

# PowerShell native approach to test SSL
$tcpClient = New-Object System.Net.Sockets.TcpClient
$tcpClient.Connect("mail.contoso.com", 443)
$sslStream = New-Object System.Net.Security.SslStream($tcpClient.GetStream(), $false, {
    param($sender, $certificate, $chain, $sslPolicyErrors)

    Write-Host "SSL Policy Errors: $sslPolicyErrors" -ForegroundColor Yellow
    Write-Host "Certificate Subject: $($certificate.Subject)"
    Write-Host "Certificate Issuer: $($certificate.Issuer)"
    Write-Host "Valid From: $($certificate.GetEffectiveDateString())"
    Write-Host "Valid To: $($certificate.GetExpirationDateString())"

    Write-Host "`nChain Elements:" -ForegroundColor Cyan
    foreach ($element in $chain.ChainElements) {
        Write-Host "  - $($element.Certificate.Subject)"
    }

    Write-Host "`nChain Status:" -ForegroundColor Cyan
    foreach ($status in $chain.ChainStatus) {
        Write-Host "  - $($status.Status): $($status.StatusInformation)"$status.StatusInformation)"
    }

    return $true  # Accept for testing purposes
})

try {
    $sslStream.AuthenticateAsClient("mail.contoso.com")
} finally {
    $sslStream.Close()
    $tcpClient.Close()
}

# Check Intermediate Certification Authorities store
Write-Host "Intermediate CA Certificates:" -ForegroundColor Cyan
Get-ChildItem Cert:\LocalMachine\CA |
    Select-Object Subject, Issuer, NotAfter, Thumbprint |
    Format-Table -Wrap

# Check Trusted Root Certification Authorities
Write-Host "`nTrusted Root CAs:" -ForegroundColor Cyan
Get-ChildItem Cert:\LocalMachine\Root |
    Where-Object { $_.NotAfter -lt (Get-Date).AddDays(90) } |
    Select-Object Subject, NotAfter |
    Sort-Object NotAfter |
    Format-Table -AutoSize

# Find certificates about to expire in chain stores
Write-Host "`nExpiring Chain Certificates (next 90 days):" -ForegroundColor Yellow
@('Root', 'CA') | ForEach-Object {
    $storeName = $_
    Get-ChildItem "Cert:\LocalMachine\$storeName" |
        Where-Object { $_.NotAfter -lt (Get-Date).AddDays(90) -and $_.NotAfter -gt (Get-Date) } |
        Select-Object @{N='Store';E={$storeName}}, Subject, NotAfter
} | Format-Table -AutoSize

# Method 1: Import PFX with complete chain
# Ensure your PFX file includes all certificates in the chain

$pfxPath = "C:\Certificates\exchange-cert-with-chain.pfx"-with-chain.pfx"
$pfxPassword = Read-Host "Enter PFX password" -AsSecureString

# Import with chain preservation
$importParams = @{
    FilePath = $pfxPath
    Password = $pfxPassword
    PrivateKeyExportable = $true
}
Import-ExchangeCertificate @importParams

# Method 2: Manually install each certificate in chain

# Install Root CA (if internal PKI)
$rootCert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$rootCert.Import("C:\Certificates\RootCA.cer")
$rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
$rootStore.Open("ReadWrite")
$rootStore.Add($rootCert)
$rootStore.Close()

# Install Intermediate CA(s)
$intermediateCerts = @(
    "C:\Certificates\IntermediateCA1.cer",
    "C:\Certificates\IntermediateCA2.cer"
)

$caStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("CA", "LocalMachine")
$caStore.Open("ReadWrite")

foreach ($certPath in $intermediateCerts) {
    $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
    $cert.Import($certPath)
    $caStore.Add($cert)
    Write-Host "Installed: $($cert.Subject)" -ForegroundColor Green
}
$caStore.Close()

# Verify complete chain
Write-Host "`nVerifying certificate chain..." -ForegroundColor Cyan
$exchangeCert = Get-ExchangeCertificate | Where-Object { $_.Services -match 'IIS' }
certutil -verify -urlfetch $exchangeCert.Thumbprint

# Find expired certificates in chain stores
Write-Host "Checking for expired chain certificates..." -ForegroundColor Cyan

$expiredCerts = @()
@('Root', 'CA') | ForEach-Object {
    $storeName = $_
    Get-ChildItem "Cert:\LocalMachine\$storeName" |
        Where-Object { $_.NotAfter -lt (Get-Date) } |
        ForEach-Object {
            $expiredCerts += [PSCustomObject]@{
                Store = $storeName
                Subject = $_.Subject
                Expired = $_.NotAfter
                Thumbprint = $_.Thumbprint
            }
        }
}

$expiredCerts | Format-Table -AutoSize

# Update Windows root certificates via Windows Update
# This downloads the latest root certificate list from Microsoft
certutil -generateSSTFromWU roots.sst
certutil -addstore -f Root roots.sst
Remove-Item roots.sst

# For internal PKI - get updated CA certificates from your PKI team
# Remove old CA certificate
$oldThumbprint = "OLD_CERTIFICATE_THUMBPRINT"
$caStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("CA", "LocalMachine")
$caStore.Open("ReadWrite")
$oldCert = $caStore.Certificates | Where-Object { $_.Thumbprint -eq $oldThumbprint }
if ($oldCert) {
    $caStore.Remove($oldCert)
    Write-Host "Removed expired certificate: $($oldCert.Subject)" -ForegroundColor Yellow
}
$caStore.Close()

# Import new CA certificate
$newCaPath = "C:\Certificates\NewIntermediateCA.cer"
certutil -addstore CA $newCaPath

# Check current IIS SSL bindings
Import-Module WebAdministration
Get-ChildItem IIS:\SslBindings | Format-Table -AutoSize

# Remove problematic binding
$bindingIP = "0.0.0.0"0.0.0"
$bindingPort = 443
Remove-Item "IIS:\SslBindings\$bindingIP!$bindingPort"$bindingPort" -ErrorAction SilentlyContinue

# Get the correct certificate with valid chain
$validCert = Get-ExchangeCertificate | Where-Object {
    $_.Services -match 'IIS' -and
    $_.NotAfter -gt (Get-Date)
} | Select-Object -First 1

# Rebind certificate to IIS
$validCert | Enable-ExchangeCertificate -Services IIS -Force

# Verify binding
Write-Host "`nUpdated SSL Bindings:" -ForegroundColor Cyan
Get-ChildItem IIS:\SslBindings | Format-Table

# Check Exchange virtual directory certificates
Get-ExchangeCertificate | Where-Object { $_.Services -ne 'None' } |
    Select-Object Thumbprint, Services, Subject, NotAfter |
    Format-Table -AutoSize

# Reset IIS with certificate update
iisreset /noforce

# Re-enable certificate for all Exchange services
$thumbprint = $validCert.Thumbprint
Enable-ExchangeCertificate -Thumbprint $thumbprint -Services IIS,SMTP,POP,IMAP -Force

# Check CRL distribution points accessibility
$cert = Get-ExchangeCertificate | Where-Object { $_.Services -match 'IIS' }

# Extract CRL URLs from certificate
$crlUrls = $cert.Extensions | Where-Object {
    $_.Oid.FriendlyName -eq "CRL Distribution Points"
} | ForEach-Object {
    $_.Format($true)
}
Write-Host "CRL Distribution Points:" -ForegroundColor Cyan
$crlUrls

# Test CRL accessibility
$crlTestUrls = @(
    "http://crl3.digicert.com/sha2-ev-server-g2.crl"-server-g2.crl",
    "http://crl4.digicert.com/sha2-ev-server-g2.crl"-server-g2.crl"
)

foreach ($url in $crlTestUrls) {
    try {
        $response = Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 10
        Write-Host "✓ CRL accessible: $url" -ForegroundColor Green
    } catch {
        Write-Host "✗ CRL not accessible: $url" -ForegroundColor Red
        Write-Host "  Error: $($_.Exception.Message)" -ForegroundColor Yellow
    }
}

# If CRL is blocked, configure proxy or firewall exception
# Check proxy settings
netsh winhttp show proxy

# Configure proxy for certificate validation (if needed)
# netsh winhttp set proxy proxy-server="proxy.contoso.com:8080""proxy.contoso.com:8080"

# Alternative: Configure registry to use cached CRL
# WARNING: This reduces security - use only if CRL access is impossible
$regPath = "HKLM:\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config"
# Set-ItemProperty -Path $regPath -Name "ChainUrlRetrievalTimeoutMilliseconds" -Value 15000-Path $regPath -Name "ChainUrlRetrievalTimeoutMilliseconds" -Value 15000

# Verify certificate revocation status
certutil -verify -urlfetch $cert.Thumbprint

# Export certificates for Group Policy distribution
# Run on CA server or server with chain certificates

# Export Root CA
$rootCert = Get-ChildItem Cert:\LocalMachine\Root |
    Where-Object { $_.Subject -like "*Contoso Root CA*" }
Export-Certificate -Cert $rootCert -FilePath "C:\GPO\RootCA.cer"

# Export Intermediate CA(s)
$intermediateCerts = Get-ChildItem Cert:\LocalMachine\CA |
    Where-Object { $_.Subject -like "*Contoso*" }
$i = 1
foreach ($cert in $intermediateCerts) {
    Export-Certificate -Cert $cert -FilePath "C:\GPO\IntermediateCA$i.cer"
    $i++
}

# Create GPO for certificate distribution (run on DC)
# Using Group Policy Management PowerShell module
Import-Module GroupPolicy

$gpoName = "Certificate Distribution - Exchange"
New-GPO -Name $gpoName

# Link to appropriate OU
$ouPath = "OU=Servers,DC=contoso,DC=com"
New-GPLink -Name $gpoName -Target $ouPath

Write-Host @"
GPO Created: $gpoName

Manual steps to complete in Group Policy Management:
1. Edit the GPO
2. Navigate to: Computer Configuration > Policies > Windows Settings >
   Security Settings > Public Key Policies
3. Import Root CA to: Trusted Root Certification Authorities
4. Import Intermediate CA(s) to: Intermediate Certification Authorities
5. Run 'gpupdate /force' on Exchange servers
"1. Edit the GPO
2. Navigate to: Computer Configuration > Policies > Windows Settings >
   Security Settings > Public Key Policies
3. Import Root CA to: Trusted Root Certification Authorities
4. Import Intermediate CA(s) to: Intermediate Certification Authorities
5. Run 'gpupdate /force' on Exchange servers
"@ -ForegroundColor Yellow

# Force Group Policy update on Exchange server
gpupdate /force

# Verify certificates were distributed
Write-Host "`nVerifying certificate stores after GPO..." -ForegroundColor Cyan
Get-ChildItem Cert:\LocalMachine\Root |
    Where-Object { $_.Subject -like "*Contoso*" } |
    Select-Object Subject, Thumbprint

Get-ChildItem Cert:\LocalMachine\CA |
    Where-Object { $_.Subject -like "*Contoso*" } |
    Select-Object Subject, Thumbprint