Repository: microsoft/CSS-Exchange
File: Diagnostics/HealthChecker/DataCollection/ExchangeInformation/Get-ExchangeServerCertificates.ps1 (PowerShell)

Code before:
            $skiplistEntry = $ExclusionObject[$certificateIndex]
            if ($skiplistEntry -ne -1) {
                return ($skiplistEntry.IsSelfSigned -eq $Certificate.IsSelfSigned)
            } else {
                return $false
            }
        } else {
            return $false
        }
    }

    try {
        if ($ExcludeCertificatesOnSkiplist) {
            Write-Verbose "Build certificate exclusion list"
            # Add the certificates that should be excluded from the Exchange certificate check (we don't return an object for them)
            $certificatesToExclude = @(
                # Exclude "MS-Organization-P2P-Access [YYYY]" certificate with one day lifetime on Azure hosted machines.
                # See: What are the MS-Organization-P2P-Access certificates present on our Windows 10/11 devices?
                # https://docs.microsoft.com/azure/active-directory/devices/faq
                NewCertificateExclusionEntry -IssuerOrSubjectPattern "CN=MS-Organization-P2P-Access \[[12][0-9]{3}\]$" -IsSelfSigned $true
                # Exclude "DC=Windows Azure CRP Certificate Generator" (TenantEncryptionCertificate)
                # The certificates are built by the Azure fabric controller and passed to the Azure VM Agent.
                # If you stop and start the VM every day, the fabric controller might create a new certificate.
                # These certificates can be deleted. The Azure VM Agent re-creates certificates if needed.
                # https://docs.microsoft.com/azure/virtual-machines/extensions/features-windows
                NewCertificateExclusionEntry -IssuerOrSubjectPattern "DC=Windows Azure CRP Certificate Generator" -IsSelfSigned $true
            )
        }
        Write-Verbose "Trying to receive certificates from Exchange server: $($Script:Server)"
        $exchangeServerCertificates = Get-ExchangeCertificate -Server $Script:Server -ErrorAction Stop

        if ($null -ne $exchangeServerCertificates) {
            try {
                $authConfig = Get-AuthConfig -ErrorAction Stop
                $authConfigDetected = $true
            } catch {
                $authConfigDetected = $false
                Invoke-CatchActions
            }

            [array]$certObject = @()
            foreach ($cert in $exchangeServerCertificates) {
                try {
                    $certificateLifetime = ([System.Convert]::ToDateTime($cert.NotAfter, [System.Globalization.DateTimeFormatInfo]::InvariantInfo) - (Get-Date)).Days
                    $sanCertificateInfo = $false
                    $excludeCertificate = $false

                    if ($ExcludeCertificatesOnSkiplist) {
                        $excludeCertificate = ShouldCertificateBeSkipped -Exclusions $certificatesToExclude -Certificate $cert
                    }


Review comment (refactor):
Let's clean up the comments to be outside the list.
```suggestion
            # Add the certificates that should be excluded from the Exchange certificate check (we don't return an object for them)
                # Exclude "MS-Organization-P2P-Access [YYYY]" certificate with one day lifetime on Azure hosted machines.
                # See: What are the MS-Organization-P2P-Access certificates present on our Windows 10/11 devices?
                # https://docs.microsoft.com/azure/active-directory/devices/faq
                 # Exclude "DC=Windows Azure CRP Certificate Generator" (TenantEncryptionCertificate)
                # The certificates are built by the Azure fabric controller and passed to the Azure VM Agent.
                # If you stop and start the VM every day, the fabric controller might create a new certificate.
                # These certificates can be deleted. The Azure VM Agent re-creates certificates if needed.
                # https://docs.microsoft.com/azure/virtual-machines/extensions/features-windows
            $certificatesToExclude = @(
                NewCertificateExclusionEntry  "CN=MS-Organization-P2P-Access \[[12][0-9]{3}\]$" $true
                NewCertificateExclusionEntry "DC=Windows Azure CRP Certificate Generator" $true
```
You should be able to get by with two parameters without needing to pass the parameter name. 

Code after:
        # Exclude "DC=Windows Azure CRP Certificate Generator" (TenantEncryptionCertificate)
        # The certificates are built by the Azure fabric controller and passed to the Azure VM Agent.
        # If you stop and start the VM every day, the fabric controller might create a new certificate.
        # These certificates can be deleted. The Azure VM Agent re-creates certificates if needed.
        # https://docs.microsoft.com/azure/virtual-machines/extensions/features-windows
        $certificatesToExclude = @(
            NewCertificateExclusionEntry "CN=MS-Organization-P2P-Access \[[12][0-9]{3}\]$" $true
            NewCertificateExclusionEntry "DC=Windows Azure CRP Certificate Generator" $true
        )
        Write-Verbose "Trying to receive certificates from Exchange server: $($Script:Server)"
        $exchangeServerCertificates = Get-ExchangeCertificate -Server $Script:Server -ErrorAction Stop

        if ($null -ne $exchangeServerCertificates) {
            try {
                $authConfig = Get-AuthConfig -ErrorAction Stop
                $authConfigDetected = $true
            } catch {
                $authConfigDetected = $false
                Invoke-CatchActions
            }

            [array]$certObject = @()
            foreach ($cert in $exchangeServerCertificates) {
                try {
                    $certificateLifetime = ([System.Convert]::ToDateTime($cert.NotAfter, [System.Globalization.DateTimeFormatInfo]::InvariantInfo) - (Get-Date)).Days
                    $sanCertificateInfo = $false

                    $excludeCertificate = ShouldCertificateBeSkipped -Exclusions $certificatesToExclude -Certificate $cert

                    if ($excludeCertificate) {
                        Write-Verbose "Excluding certificate $($cert.Subject). Moving to next certificate"
                        continue
                    }

                    $currentErrors = $Error.Count
                    if ($null -ne $cert.DnsNameList -and
                        ($cert.DnsNameList).Count -gt 1) {
                        $sanCertificateInfo = $true
                        $certDnsNameList = $cert.DnsNameList
                    } elseif ($null -eq $cert.DnsNameList) {
                        $certDnsNameList = "None"
                    } else {
                        $certDnsNameList = $cert.DnsNameList
                    }
                    if ($currentErrors -lt $Error.Count) {
                        $i = 0
                        while ($i -lt ($Error.Count - $currentErrors)) {
                            Invoke-CatchActions $Error[$i]
                            $i++
                        }
                    }