{
    "properties": {
        "displayName": "Audit Windows machines that contain certificates expiring within the specified number of days",
        "policyType": "BuiltIn",
        "mode": "Indexed",
        "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol. Machines are non-compliant if certificates in the specified store have an expiration date out of range for the number of days given as parameter. The policy also provides the option to only check for specific certificates or exclude specific certificates, and whether to report on expired certificates.",
        "metadata": {
            "category": "Guest Configuration",
            "version": "1.0.0",
            "requiredProviders": [
                "Microsoft.GuestConfiguration"
            ],
            "guestConfiguration": {
                "name": "CertificateExpiration",
                "version": "1.*",
                "configurationParameter": {
                    "CertificateStorePath": "[CertificateStore]CertificateStore1;CertificateStorePath",
                    "ExpirationLimitInDays": "[CertificateStore]CertificateStore1;ExpirationLimitInDays",
                    "CertificateThumbprintsToInclude": "[CertificateStore]CertificateStore1;CertificateThumbprintsToInclude",
                    "CertificateThumbprintsToExclude": "[CertificateStore]CertificateStore1;CertificateThumbprintsToExclude",
                    "IncludeExpiredCertificates": "[CertificateStore]CertificateStore1;IncludeExpiredCertificates"
                }
            }
        },
        "parameters": {
            "IncludeArcMachines": {
                "type": "string",
                "metadata": {
                    "displayName": "Include Arc connected servers",
                    "description": "By selecting this option, you agree to be charged monthly per Arc connected machine."
                },
                "allowedValues": [
                    "true",
                    "false"
                ],
                "defaultValue": "false"
            },
            "CertificateStorePath": {
                "type": "string",
                "metadata": {
                    "displayName": "Certificate store path",
                    "description": "The path to the certificate store containing the certificates to check the expiration dates of. Default value is 'Cert:' which is the root certificate store path, so all certificates on the machine will be checked. Other example paths: 'Cert:\\LocalMachine', 'Cert:\\LocalMachine\\TrustedPublisher', 'Cert:\\CurrentUser'"
                },
                "defaultValue": "Cert:"
            },
            "ExpirationLimitInDays": {
                "type": "string",
                "metadata": {
                    "displayName": "Expiration limit in days",
                    "description": "An integer indicating the number of days within which to check for certificates that are expiring. For example, if this value is 30, any certificate expiring within the next 30 days will cause this policy to be non-compliant."
                },
                "defaultValue": "30"
            },
            "CertificateThumbprintsToInclude": {
                "type": "string",
                "metadata": {
                    "displayName": "Certificate thumbprints to include",
                    "description": "A semicolon-separated list of certificate thumbprints to check under the specified path. If a value is not specified, all certificates under the certificate store path will be checked. If a value is specified, no certificates other than those with the thumbprints specified will be checked. e.g. THUMBPRINT1;THUMBPRINT2;THUMBPRINT3"
                },
                "defaultValue": ""
            },
            "CertificateThumbprintsToExclude": {
                "type": "string",
                "metadata": {
                    "displayName": "Certificate thumbprints to exclude",
                    "description": "A semicolon-separated list of certificate thumbprints to ignore. e.g. THUMBPRINT1;THUMBPRINT2;THUMBPRINT3"
                },
                "defaultValue": ""
            },
            "IncludeExpiredCertificates": {
                "type": "string",
                "metadata": {
                    "displayName": "Include expired certificates",
                    "description": "Must be 'true' or 'false'. True indicates that any found certificates that have already expired will also make this policy non-compliant. False indicates that certificates that have expired will be be ignored."
                },
                "allowedValues": [
                    "true",
                    "false"
                ],
                "defaultValue": "false"
            }
        },
        "policyRule": {
            "if": {
                "anyOf": [
                    {
                        "allOf": [
                            {
                                "field": "type",
                                "equals": "Microsoft.Compute/virtualMachines"
                            },
                            {
                                "anyOf": [
                                    {
                                        "field": "Microsoft.Compute/imagePublisher",
                                        "in": [
                                            "esri",
                                            "incredibuild",
                                            "MicrosoftDynamicsAX",
                                            "MicrosoftSharepoint",
                                            "MicrosoftVisualStudio",
                                            "MicrosoftWindowsDesktop",
                                            "MicrosoftWindowsServerHPCPack"
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "MicrosoftWindowsServer"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageSKU",
                                                "notLike": "2008*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "MicrosoftSQLServer"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "notLike": "SQL2008*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "microsoft-dsvm"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "equals": "dsvm-windows"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "microsoft-ads"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "in": [
                                                    "standard-data-science-vm",
                                                    "windows-data-science-vm"
                                                ]
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "batch"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "equals": "rendering-windows2016"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "center-for-internet-security-inc"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "cis-windows-server-201*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "pivotal"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "bosh-windows-server*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "cloud-infrastructure-services"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "ad*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "anyOf": [
                                                    {
                                                        "field": "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration",
                                                        "exists": "true"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
                                                        "like": "Windows*"
                                                    }
                                                ]
                                            },
                                            {
                                                "anyOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imageSKU",
                                                        "exists": "false"
                                                    },
                                                    {
                                                        "allOf": [
                                                            {
                                                                "field": "Microsoft.Compute/imageSKU",
                                                                "notLike": "2008*"
                                                            },
                                                            {
                                                                "field": "Microsoft.Compute/imageOffer",
                                                                "notLike": "SQL2008*"
                                                            }
                                                        ]
                                                    }
                                                ]
                                            }
                                        ]
                                    }
                                ]
                            }
                        ]
                    },
                    {
                        "allOf": [
                            {
                                "value": "[parameters('IncludeArcMachines')]",
                                "equals": "true"
                            },
                            {
                                "field": "type",
                                "equals": "Microsoft.HybridCompute/machines"
                            },
                            {
                                "field": "Microsoft.HybridCompute/imageOffer",
                                "like": "windows*"
                            }
                        ]
                    }
                ]
            },
            "then": {
                "effect": "auditIfNotExists",
                "details": {
                    "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
                    "name": "CertificateExpiration",
                    "existenceCondition": {
                        "allOf": [
                            {
                                "field": "Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus",
                                "equals": "Compliant"
                            },
                            {
                                "field": "Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash",
                                "equals": "[base64(concat('[CertificateStore]CertificateStore1;CertificateStorePath', '=', parameters('CertificateStorePath'), ',', '[CertificateStore]CertificateStore1;ExpirationLimitInDays', '=', parameters('ExpirationLimitInDays'), ',', '[CertificateStore]CertificateStore1;CertificateThumbprintsToInclude', '=', parameters('CertificateThumbprintsToInclude'), ',', '[CertificateStore]CertificateStore1;CertificateThumbprintsToExclude', '=', parameters('CertificateThumbprintsToExclude'), ',', '[CertificateStore]CertificateStore1;IncludeExpiredCertificates', '=', parameters('IncludeExpiredCertificates')))]"
                            }
                        ]
                    }
                }
            }
        }
    },
    "id": "/providers/Microsoft.Authorization/policyDefinitions/1417908b-4bff-46ee-a2a6-4acc899320ab",
    "name": "1417908b-4bff-46ee-a2a6-4acc899320ab"
}