From 18dc8157b32b0789907087826a2ffcd67083a72f Mon Sep 17 00:00:00 2001 From: Anwar Date: Fri, 14 Aug 2026 15:06:54 +0300 Subject: [PATCH] Fix incorrect expiry check in ConfigureCrmServerSideSync.ps1 endDateTime comes back from the Graph API response as a string, while currentDateTime is a DateTime object. Comparing them with -lt coerces the DateTime to a string and does a lexicographic comparison instead of an actual date comparison, so expired certificates can be missed (or valid ones flagged as expired) depending on how the two string representations happen to sort. Cast endDateTime to DateTime before comparing. Fixes #797 --- powershell/ServerSideSync/ConfigureCrmServerSideSync.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/powershell/ServerSideSync/ConfigureCrmServerSideSync.ps1 b/powershell/ServerSideSync/ConfigureCrmServerSideSync.ps1 index 3cdb193ff..80254d312 100644 --- a/powershell/ServerSideSync/ConfigureCrmServerSideSync.ps1 +++ b/powershell/ServerSideSync/ConfigureCrmServerSideSync.ps1 @@ -185,7 +185,7 @@ try { for ($i = 0; $i -lt $servicePrincipalCredentials.Count; $i++) { - if ($servicePrincipalCredentials[$i].endDateTime -lt $currentDateTime) + if ([DateTime]$servicePrincipalCredentials[$i].endDateTime -lt $currentDateTime) { Write-Output("Certificate '" + $servicePrincipalCredentials[$i].displayName + "', with thumbprint '" + $servicePrincipalCredentials[$i].customKeyIdentifier + "' has expired on "+ $servicePrincipalCredentials[$i].endDateTime +". Removing the certificate principal from CRM app with id '" + $crmAppId +"'.") $removeID = $servicePrincipalCredentials[$i].keyId