[Feature Request] script to verify TLS Certificate configuration on Exchange On-prem Servers

[shasagar]

Is your request related to a problem? Please describe.
Customers often struggle to understand how exchange services select certificates to initiate TLS communication. This lack of knowledge can lead to email outages shortly after renewing their certificates.

Describe The Request
I have developed a code that enables customers to perform essential checks and identifies necessary adjustments.
https://github.com/shasagar/TlsCertificateVarification/blob/main/TLSCertificateVerification.ps1

Additional context
The script has been tested in the lab environment, which includes the following servers:
4 Mailbox Servers [2 Exchange 2013 / 1 Exchange 2016 / 1 Exchange 2019]
1 Edge Server [Exchange 2019]
2 Domain Controllers

[lusassl-msft]

@shasagar what's the ask here? Healthchecker already performs relevant checks for connectors used in hybrid mail flow scenarios and also validates that the default SMTP certificates exists on the machine. I don't think it makes sense to have another script, instead checks should be added to HC if needed. Please let us know and feel free to open a PR to make the code adjustments in Healthchecker.

[shasagar]

@lusassl-msft Thank you so much for your reference. I agree to adjust code in the existing HealthChecker rather having a new code for customers to run.
The code that I built follow the following flow chart to make sure of successful StartTLS session:

Currently HealthChecker is performing following checks:

• Validate Send/Receive connectors by checking following 2 values:
• Cloud Mail Enabled
• TlsCertificateName
• And verify exchange certificate as per TlsCertificateName

My code performs following additional checks:

• Receive Connector has 'TLS' Auth Mechanism enabled
• If TlsCertificateName is NULL, check FQDN set on the connector and if FQDN is NULL as well, search certificate as per Server FQDN
• Check and make sure certificate chain is valid and none of the chain certificate is invalid or in untrusted root.
• SMTP Service is enabled on the matching certificate

If you think these are the valid checks, we can work on updating HealthChecker script accordingly. Please suggest.

[dpaulson45]

If these checks are relatively quick, then inside of Health Checker is likely the best place for it if all the data/information is available with Exchange On Prem access only.

[shasagar]

Thanks. Let me own the task and start working in the modifications. I will keep you all informed.