Remove old CA-certificates from CA properties

Question

Hi.
I have newly deployed two-tier PKI.
While installing I've reissued CA-certt few times (both for root CA and subCA).
Now, when I open CA properties I see three root CA (both for root CA and sub CA).
I want to remove unnecessary cert from my PKI. But no matter what I do the certificates are still there.

What was done:

1. Pkiview.msc->Manage AD container - >remove all old certs - Certs was removed here, but still showing in CA properties, nothing changes.
2. I removed all old certificates in MMC console Certificates(Local Computer). After some time certs come back.
3. I've try to edit via regedit: \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\MyCA CACertHash value. After removing old Hashes from this vaules certsvc service won't to start back, so I have return this values back to allow my certsvc start up

What should I do to eliminate this certs? I've already spent a lot of time on this seemingly simple task.

Answer 1

At your point 3 by CACertHash: It is important here not to simply delete the values, but to replace them with a placeholder in the form of a hyphen "-" so that the counter for the certification authority version is retained.

Answer 2

Hello Евгений Котляревский,

Thank you for posting in Q&A forum.

If the certificates (root CA certificates and issuing CA certificates) are not expired, you can not delete any of them. If the root certificate or issuing certificates doesn't expire, you delete it, and there will be problems with the entire PKI.

If one or more of them are expired, you can delete the expired certificates.

For the root CA certificate, if it is expired, you can delete the old CA certificate from the Certification Authorities tab.

1. Start pkiview.msc.
2. Right-click Enterprise PKI, and then click Manage AD Containers.
3. Click the Certification Authorities tab.
4. Select the old root CA certificate and then delete it.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.