# Browser shows:
"Your connection is not private"
"NET::ERR_CERT_DATE_INVALID"
"This site's security certificate has expired"

# Outlook shows:
"The security certificate has expired or is not yet valid"
"There is a problem with the proxy server's security certificate"

# Mobile devices:
"Cannot Verify Server Identity"
"SSL Error - Certificate expired"

# Check all Exchange certificates
Get-ExchangeCertificate | Select-Object Subject, Thumbprint, NotAfter, Services,
    @{N='Status';E={if($_.NotAfter -lt (Get-Date)){'EXPIRED'}elseif($_.NotAfter -lt (Get-Date).AddDays(30)){'EXPIRING SOON'}else{'Valid'}}} |
    Format-Table -AutoSize

# Check specific certificate by thumbprint
Get-ExchangeCertificate -Thumbprint "ABC123..." | Format-List *

# List all certificates with expiration status
Get-ExchangeCertificate | ForEach-Object {
    $status = if ($_.NotAfter -lt (Get-Date)) { "EXPIRED" }
              elseif ($_.NotAfter -lt (Get-Date).AddDays(30)) { "EXPIRING SOON" }
              else { "Valid" }
    [PSCustomObject]@{
        Subject = $_.Subject
        Thumbprint = $_.Thumbprint.Substring(0,8) + "..."
        Expires = $_.NotAfter
        Services = $_.Services
        Status = $status
    }
} | Format-Table -AutoSize

# Check what certificate is bound to IIS
Import-Module WebAdministration
Get-WebBinding -Name "Default Web Site" -Protocol https |
    Select-Object bindingInformation, certificateHash | Format-Table

# Verify the bound certificate
$binding = Get-WebBinding -Name "Default Web Site" -Protocol https
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq $binding.certificateHash }
$cert | Select-Object Subject, NotAfter, Thumbprint

# Import new certificate (if you have a PFX file)
$pfxPath = "C:\Certs\NewExchangeCert.pfx"
$pfxPassword = Read-Host "Enter PFX password" -AsSecureString
Import-ExchangeCertificate -FileName $pfxPath -Password $pfxPassword -PrivateKeyExportable:$true

# Get the new certificate thumbprint
$newCert = Get-ExchangeCertificate | Where-Object { $_.NotAfter -gt (Get-Date) } |
    Sort-Object NotAfter -Descending | Select-Object -First 1
Write-Host "New certificate: $($newCert.Thumbprint)"

# Enable for Exchange services
Enable-ExchangeCertificate -Thumbprint $newCert.Thumbprint -Services IIS,SMTP,POP,IMAP

# Restart IIS
iisreset /noforce

# Generate new certificate request
$request = New-ExchangeCertificate -GenerateRequest -SubjectName "cn=mail.domain.com" -DomainName mail.domain.com,autodiscover.domain.com,webmail.domain.com -PrivateKeyExportable $true -KeySize 2048

# Save request to file
$request | Out-File "C:\Certs\ExchangeCSR.txt"

# Submit this CSR to your Certificate Authority (DigiCert, Comodo, etc.)
Write-Host "Submit C:\Certs\ExchangeCSR.txt to your CA"

# After receiving the certificate, import it:
# Import-ExchangeCertificate -FileName "C:\Certs\CertFromCA.cer"-FileName "C:\Certs\CertFromCA.cer"

# Request certificate from internal Enterprise CA
$template = "WebServer"  # Your web server template name
$ca = "DC01.domain.local\Domain-CA"  # Your CA server

# Create certificate request and submit to CA
$cert = Get-Certificate -Template $template -CertStoreLocation Cert:\LocalMachine\My -DnsName mail.domain.com,autodiscover.domain.com -SubjectName "CN=mail.domain.com"

# If auto-enrollment works, certificate is issued immediately
# Enable for Exchange
Enable-ExchangeCertificate -Thumbprint $cert.Certificate.Thumbprint -Services IIS,SMTP

iisreset /noforce

# WARNING: Self-signed causes client warnings - use only in emergencies
$selfSigned = New-ExchangeCertificate -Services IIS,SMTP -DomainName mail.domain.com,autodiscover.domain.com -FriendlyName "Exchange Temporary Certificate" -PrivateKeyExportable $true

Write-Host "Self-signed certificate created: $($selfSigned.Thumbprint)"$selfSigned.Thumbprint)"
Write-Host "WARNING: Clients will see certificate warnings until you install a proper CA-signed certificate"

iisreset /noforce

# Check certificate is assigned correctly
Get-ExchangeCertificate | Where-Object { $_.Services -match "IIS" } |
    Select-Object Subject, Thumbprint, NotAfter, Services | Format-List

# Test HTTPS connectivity
$urls = @(
    "https://mail.domain.com/owa/healthcheck.htm",
    "https://mail.domain.com/autodiscover/autodiscover.xml"
)
foreach ($url in $urls) {
    try {
        $response = Invoke-WebRequest -Uri $url -UseBasicParsing -TimeoutSec 10
        Write-Host "[OK] $url" -ForegroundColor Green
    } catch {
        Write-Host "[FAIL] $url" -ForegroundColor Red
    }
}

# Verify certificate chain
$webRequest = [Net.HttpWebRequest]::Create("https://mail.domain.com")
$webRequest.GetResponse() | Out-Null
$cert = $webRequest.ServicePoint.Certificate
Write-Host "Certificate Subject: $($cert.Subject)"
Write-Host "Valid Until: $($cert.GetExpirationDateString())"

# Add to scheduled task for monitoring
$threshold = 30  # Days before expiration to alert
Get-ExchangeCertificate | Where-Object {
    $_.Services -match "IIS" -and $_.NotAfter -lt (Get-Date).AddDays($threshold)
} | ForEach-Object {
    $daysLeft = ($_.NotAfter - (Get-Date)).Days
    Write-Host "WARNING: Certificate $($_.Subject) expires in $daysLeft days!"$daysLeft days!" -ForegroundColor Yellow
    # Send-MailMessage alert here
}