Repository: microsoft/CSS-Exchange
File: Diagnostics/HealthChecker/DataCollection/ExchangeInformation/Get-ExchangeServerCertificates.ps1 (PowerShell)

Code before:
            $IsSelfSigned
        )

        [PSCustomObject]@{
            IorSPattern  = $IssuerOrSubjectPattern
            IsSelfSigned = $IsSelfSigned
        }
    }

    function ShouldCertificateBeSkipped {
        [OutputType("System.Boolean")]
        param (
            [Parameter(Mandatory = $true)]
            [PSCustomObject]
            $Exclusions,
            [Parameter(Mandatory = $true)]
            [System.Security.Cryptography.X509Certificates.X509Certificate2]
            $Certificate
        )

        $certificateIndex = 0
        $certificateMatch = $false

        foreach ($exclusionEntry in $Exclusions) {
            if ($certificateMatch -eq $false) {
                switch ($exclusionEntry) {
                    ({ $Certificate.Subject -match $_.IorSPattern }) { $certificateMatch = $true; break }
                    ({ $Certificate.Issuer -match $_.IorSPattern }) { $certificateMatch = $true; break }
                    default { $certificateIndex++ }
                }
            }
        }

        if ($certificateMatch) {
            # We found a matching certificate based on subject or issuer, check for IsSelfSigned as second indicator
            $skiplistEntry = $ExclusionObject[$certificateIndex]
            if ($skiplistEntry -ne -1) {
                return ($skiplistEntry.IsSelfSigned -eq $Certificate.IsSelfSigned)
            } else {
                return $false
            }
        } else {
            return $false
        }
    }

    try {
        if ($ExcludeCertificatesOnSkiplist) {
            Write-Verbose "Build certificate exclusion list"
            # Add the certificates that should be excluded from the Exchange certificate check (we don't return an object for them)
            $certificatesToExclude = @(

Review comment (suggestion):
```suggestion
        
        $certificateMatch = $Exclusions | Where-Object { $Certficate.Subject -match $_.IorSPattern -or $Certficate.Issuer -match $_.IorSPattern } | Select-Object -First 1
        
        if ($null -ne $certificateMatch) {
           return $certificateMatch.IsSelfSigned -eq $Certificate.IsSelfSigned
        }
        return $false 
```

Code after:
        return [PSCustomObject]@{
            IorSPattern  = $IssuerOrSubjectPattern
            IsSelfSigned = $IsSelfSigned
        }
    }

    function ShouldCertificateBeSkipped {
        [OutputType("System.Boolean")]
        param (
            [Parameter(Mandatory = $true)]
            [PSCustomObject]
            $Exclusions,
            [Parameter(Mandatory = $true)]
            [System.Security.Cryptography.X509Certificates.X509Certificate2]
            $Certificate
        )

        $certificateMatch = $Exclusions | Where-Object {
            ((($Certificate.Subject -match $_.IorSPattern) -or
            ($Certificate.Issuer -match $_.IorSPattern)) -and
            ($Certificate.IsSelfSigned -eq $_.IsSelfSigned))
        } | Select-Object -First 1

        if ($null -ne $certificateMatch) {
            return $certificateMatch.IsSelfSigned -eq $Certificate.IsSelfSigned
        }
        return $false
    }

    try {
        Write-Verbose "Build certificate exclusion list"
        # Add the certificates that should be excluded from the Exchange certificate check (we don't return an object for them)
        # Exclude "MS-Organization-P2P-Access [YYYY]" certificate with one day lifetime on Azure hosted machines.
        # See: What are the MS-Organization-P2P-Access certificates present on our Windows 10/11 devices?
        # https://docs.microsoft.com/azure/active-directory/devices/faq
        # Exclude "DC=Windows Azure CRP Certificate Generator" (TenantEncryptionCertificate)
        # The certificates are built by the Azure fabric controller and passed to the Azure VM Agent.
        # If you stop and start the VM every day, the fabric controller might create a new certificate.
        # These certificates can be deleted. The Azure VM Agent re-creates certificates if needed.
        # https://docs.microsoft.com/azure/virtual-machines/extensions/features-windows
        $certificatesToExclude = @(
            NewCertificateExclusionEntry "CN=MS-Organization-P2P-Access \[[12][0-9]{3}\]$" $true
            NewCertificateExclusionEntry "DC=Windows Azure CRP Certificate Generator" $true
        )
        Write-Verbose "Trying to receive certificates from Exchange server: $($Script:Server)"
        $exchangeServerCertificates = Get-ExchangeCertificate -Server $Script:Server -ErrorAction Stop

        if ($null -ne $exchangeServerCertificates) {
            try {
                $authConfig = Get-AuthConfig -ErrorAction Stop
                $authConfigDetected = $true