Get-AzureAppServiceCertificateExpiryReport

<#
.SYNOPSIS
    Reports Azure App Service certificates that are expiring soon.

.DESCRIPTION
    Loops through App Service certificates in the current Azure subscription
    (or a list of subscriptions you pass in) and flags any custom domain
    certificate expiring within a given number of days. Useful for catching
    a lapsed SSL certificate before a customer does.

.PARAMETER SubscriptionId
    One or more subscription IDs to check. If you skip this, the script uses
    whatever subscription your current Az session is pointed at.

.PARAMETER DaysThreshold
    How many days out counts as "expiring soon". Defaults to 30.

.EXAMPLE
    .\Get-AzureAppServiceCertificateExpiryReport.ps1 -DaysThreshold 45

.EXAMPLE
    .\Get-AzureAppServiceCertificateExpiryReport.ps1 -SubscriptionId "sub-id-1","sub-id-2" | Export-Csv .\cert-report.csv -NoTypeInformation

.AUTHOR
    Shehryar Hassan
#>

[CmdletBinding()]
param(
    [string[]]$SubscriptionId,
    [int]$DaysThreshold = 30
)

if (-not (Get-Module -ListAvailable -Name Az.Websites)) {
    Write-Error "The Az.Websites module is not installed. Run: Install-Module Az.Websites -Scope CurrentUser"
    return
}

if (-not (Get-AzContext)) {
    Connect-AzAccount | Out-Null
}

$subs = if ($SubscriptionId) { $SubscriptionId } else { (Get-AzContext).Subscription.Id }

$results = foreach ($sub in $subs) {
    Set-AzContext -SubscriptionId $sub | Out-Null
    Write-Verbose "Checking subscription $sub"

    $certs = Get-AzWebAppCertificate

    foreach ($cert in $certs) {
        $daysLeft = ($cert.ExpirationDate - (Get-Date)).Days

        [PSCustomObject]@{
            SubscriptionId  = $sub
            CertificateName = $cert.Name
            ResourceGroup   = $cert.ResourceGroup
            HostName        = $cert.HostNames -join ", "
            ExpirationDate  = $cert.ExpirationDate
            DaysUntilExpiry = $daysLeft
            Status          = if ($daysLeft -le 0) { "Expired" }
                               elseif ($daysLeft -le $DaysThreshold) { "Expiring soon" }
                               else { "OK" }
        }
    }
}

$flagged = $results | Where-Object { $_.Status -ne "OK" } | Sort-Object DaysUntilExpiry

if (-not $flagged) {
    Write-Host "No App Service certificates are within $DaysThreshold days of expiring."
} else {
    $flagged | Format-Table -AutoSize
}

$results