Share via

Remove old CA-certificates from CA properties

Евгений Котляревский 21 Reputation points
2024-07-01T22:24:22.3333333+00:00

Hi.
I have newly deployed two-tier PKI.
While installing I've reissued CA-certt few times (both for root CA and subCA).
Now, when I open CA properties I see three root CA (both for root CA and sub CA).
I want to remove unnecessary cert from my PKI. But no matter what I do the certificates are still there.
User's image

User's image

What was done:

  1. Pkiview.msc->Manage AD container - >remove all old certs - Certs was removed here, but still showing in CA properties, nothing changes.
  2. I removed all old certificates in MMC console Certificates(Local Computer). After some time certs come back.
  3. I've try to edit via regedit: \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\MyCA CACertHash value. After removing old Hashes from this vaules certsvc service won't to start back, so I have return this values back to allow my certsvc start up

What should I do to eliminate this certs? I've already spent a lot of time on this seemingly simple task.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,228 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Patrick de Vries 5 Reputation points
    2024-07-19T12:12:45.7+00:00

    At your point 3 by CACertHash: It is important here not to simply delete the values, but to replace them with a placeholder in the form of a hyphen "-" so that the counter for the certification authority version is retained.

    1 person found this answer helpful.
  2. Daisy Zhou 25,061 Reputation points Microsoft Vendor
    2024-07-02T12:05:36.9466667+00:00

    Hello Евгений Котляревский,

    Thank you for posting in Q&A forum.

    If the certificates (root CA certificates and issuing CA certificates) are not expired, you can not delete any of them. If the root certificate or issuing certificates doesn't expire, you delete it, and there will be problems with the entire PKI.

    If one or more of them are expired, you can delete the expired certificates.

    For the root CA certificate, if it is expired, you can delete the old CA certificate from the Certification Authorities tab.

    1. Start pkiview.msc.
    2. Right-click Enterprise PKI, and then click Manage AD Containers.
    3. Click the Certification Authorities tab.
    4. Select the old root CA certificate and then delete it.Machine generated alternative text:orpBDCCA Properties Extensions Enrollment Agents General Storage Auditing Certificate Managers Recovery Agents Security Poiicy Module Exit Module Certification authority (CA) Name: CA certificates: corpBDCC4 Certificate ex ired Certificate WI View Certificate Cryptographic settings Provider: Hash algorithm: Microsoft Shong Cryptographic Provider

    I hope the information above is helpful.

    If you have any questions or concerns, please feel free to let us know.

    Best Regards,

    Daisy Zhou

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.