# Read-only prerequisite report. This does not install software or change IIS/DNS.
# Run in Administrator PowerShell: .\check-automatic-renewal.ps1 -SiteName "Your site" -Hostname example.com
[CmdletBinding()]
param([Parameter(Mandatory)][ValidatePattern('^[\w .-]{1,80}$')][string]$SiteName,[Parameter(Mandatory)][ValidatePattern('^(?=.{1,253}$)(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z][a-zA-Z0-9-]{1,62}$')][string]$Hostname)
$ErrorActionPreference='Stop'
$administrator=([Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
$os=(Get-CimInstance Win32_OperatingSystem).Caption
$platform=$os -like '*Windows Server 2025*'
$installed=$false;$siteFound=$false;$exactHttp=$false
try {
 Import-Module WebAdministration
 $installed=(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\InetStp').MajorVersion -eq 10
 $site=@(Get-Website|Where-Object Name -eq $SiteName)
 $siteFound=$site.Count -eq 1
 if($siteFound){$exactHttp=@(Get-WebBinding -Name $SiteName -Protocol http|Where-Object {$_.bindingInformation.EndsWith(':80:'+$Hostname,[StringComparison]::OrdinalIgnoreCase)}).Count -gt 0}
} catch {}
$dns=@();foreach($type in @('A','AAAA')){try{$dns+=@(Resolve-DnsName -Name $Hostname -Type $type -DnsOnly -ErrorAction Stop|Where-Object IPAddress|Select-Object -ExpandProperty IPAddress)}catch{}}
function Test-PublicAddress([string]$Value) {
 $ip=[Net.IPAddress]::Parse($Value);$b=$ip.GetAddressBytes()
 if($ip.AddressFamily -eq [Net.Sockets.AddressFamily]::InterNetwork){
  if($b[0] -in @(0,10,127) -or $b[0] -ge 224){return $false}
  if(($b[0] -eq 100 -and $b[1] -ge 64 -and $b[1] -le 127) -or ($b[0] -eq 169 -and $b[1] -eq 254) -or ($b[0] -eq 172 -and $b[1] -ge 16 -and $b[1] -le 31)){return $false}
  if(($b[0] -eq 192 -and ($b[1] -eq 168 -or ($b[1] -eq 0 -and $b[2] -in @(0,2)) -or ($b[1] -eq 88 -and $b[2] -eq 99))) -or ($b[0] -eq 198 -and ($b[1] -in @(18,19) -or ($b[1] -eq 51 -and $b[2] -eq 100))) -or ($b[0] -eq 203 -and $b[1] -eq 0 -and $b[2] -eq 113)){return $false}
  return $true
 }
 return ($b[0] -band 0xe0) -eq 0x20 -and -not($b[0] -eq 0x20 -and $b[1] -eq 0x01 -and $b[2] -eq 0x0d -and $b[3] -eq 0xb8)
}
$publicDns=$dns.Count -gt 0 -and @($dns|Where-Object {-not(Test-PublicAddress $_)}).Count -eq 0
[pscustomobject]@{
 Mode='Read-only';Hostname=$Hostname;Administrator=$administrator;TestedOperatingSystem=$platform;Iis10=$installed;SiteFound=$siteFound;ExactHostnameHttp80Binding=$exactHttp;DnsAddresses=$dns;PublicDnsConfigured=$publicDns
 PrerequisitesReady=($administrator -and $platform -and $installed -and $siteFound -and $exactHttp -and $publicDns)
 ExternalValidationStillRequired=$true
 Scope='Tested Windows Server2025/IIS10 HTTP-01 path only. This report cannot prove external firewall/proxy reachability or successful renewal installation.'
 Unsupported='Wildcard DNS APIs,managed hosting,other versions and unusual proxies require a compatibility review.'
 ChangedSettings=$false;UploadedData=$false
}|ConvertTo-Json -Depth 5