[Issue] - Health Checker - Edge check for Default internal Certificate missing

[Guytou777]

Provide Version Number
Exchange Health Checker version 25.04.18.1944

Describe the issue
What is currently displayed on this topic when running HC on an Edge server

Valid Internal Transport Certificate Found On Server: False
We can't check for Internal Transport Certificate on Edge Transport Servers

Expected behavior
To display the information as for a Mailbox server because this is relevant like edge syn use the public cert of the edge default internal cert to encypt the communications

We need :
Internal Transport Certificate: True => in the certificate detail (as for Mbx role)
Valid Internal Transport Certificate Found On Server: True/False at the end of cert check part (as for Mbx role)
Ping me if more details are needed 👍

[dpaulson45]

The value that we are getting for Internal Transport Certificate is from AD, and we can't query AD from the Edge Server. I believe that is why this is setup this way.

@lusassl-msft for awareness.

[Guytou777]

Interesting, maybe the test should be done using get-clientaccessserver cmdlet instead Cordialement, Regards, Gael Istasses Support Escalation Engineer Office Product Group EMEA Exchange & Outlook Customer Services and Support Office: +33 (1) 57752611 Based in France ***@***.******@***.***> Working hours: Mon-Fri 9-18 CET [Microsoft Logo] Team Manager | Yolande Dupoy ***@***.******@***.***>) +33 (1) 57753129 From: David Paulson ***@***.***> Sent: mercredi 7 mai 2025 15:00 To: microsoft/CSS-Exchange ***@***.***> Cc: Author ***@***.***> Subject: Re: [microsoft/CSS-Exchange] [Issue] - Health Checker - Edge check for Default internal Certificate missing (Issue #2324) The value that we are getting for Internal Transport Certificate is from AD, and we can't query AD from the Edge Server. I believe that is why this is setup this way. @lusassl-msft<https://github.com/lusassl-msft> for awareness. - Reply to this email directly, view it on GitHub<#2324 (comment)> or unsubscribe<https://github.com/notifications/unsubscribe-auth/AY25PYABVHBHW5EOAVQQOCT25H7WVBFKMF2HI4TJMJ2XIZLTSWBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTAVFOZQWY5LFUVUXG43VMWSG4YLNMWVXI2DSMVQWIX3UPFYGLAVFOZQWY5LFVIZDONZTGEYDSOJWGKSG4YLNMWUWQYLTL5WGCYTFNSBKK5TBNR2WLKRSHEZTEOJYHEYTOMVENZQW2ZNJNBQXGX3MMFRGK3FMON2WE2TFMN2F65DZOBS2YSLTON2WKQ3PNVWWK3TUUZ2G64DJMNZZJAVEOR4XAZNKOJSXA33TNF2G64TZUV3GC3DVMWUTEOBVGYZDQNRRHCBKI5DZOBS2K2LTON2WLJLWMFWHKZNKGMYDINJRGQ4DSNJWQKSHI6LQMWSWYYLCMVWKK5TBNR2WLKRSG43TGMJQHE4TMMUCUR2HS4DFUVWGCYTFNSSXMYLMOVS2UMRZGMZDSOBZGE3TFJ3UOJUWOZ3FOKTGG4TFMF2GK>. You are receiving this email because you authored the thread. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[dpaulson45]

Get-ClientAccessServer isn't a valid cmdlet. Need to understand what we are looking for here and if we can even do this from the Edge Server. @Guytou777 can you explain some more on this?

[Guytou777]

Wow Sorry I was drunk :-o , I would mean we can check the value with :

get-transportservice | ft name, InternalTransportCertificateThumbprint

[dpaulson45]

@Guytou777 so what are we needing to check here then? Is it just that we have the certificate on the server, like InternalTransportCertificateThumbprint from Get-TransportService we have a certificate that matches this on the server from Get-ExchangeCertificate?

[Guytou777]

yes to align the check with what is doing the Mailbox role (most probably the get-transportservice command usage is more accurate)

If you want to go further you can also do a check if this cert is properly the Edge self sign certificate.
This is an important like this is the cert use by edgesync encryption, and it avoid to have to recreate the edge sync everytime another certificate expire (most common customer mistake is to use the third party cert of the edge as default transport ;-) )