What to do about and expired or about to expire certificate

Question

What to do about and expired or about to expire certificate

GREG ROBERTS 1

From Event Viewer "Certificate for local system with Thumbprint 70 c4 c2 a6 2b f3 34 e2 c8 74 98 56 51 f6 a4 bf a8 c6 e7 21 is about to expire or already expired."

What should I do about this?

Greg

Reza-Ameri 17,341 Reputation points Volunteer Moderator

2021-11-15T16:45:12.45+00:00

Are you facing this issue in the Windows 11?
Did you installed any new program before this problem started?
Is your device part of domain or company's network?
GREG ROBERTS 1 Reputation point

2021-11-15T16:50:41.223+00:00
Thanks for this fast reply!!

This event was present before I upgraded to Win 11.

No new programs added.

Not part of a domain or company network.
GREG ROBERTS 1 Reputation point

2021-11-15T16:55:58.36+00:00

Thanks for this fast reply!!

This event was present before I upgraded to Win 11.
No new programs added.
Not part of a domain or company network.
Reza-Ameri 17,341 Reputation points Volunteer Moderator

2021-11-15T16:59:16.5+00:00

Are you seeing this message only inside the Event Viewer?
Are you facing this issue with any other application?
You may report this issue using the Feedback Hub app.

1 answer

Your answer

Reza-Ameri 17,341 Reputation points Volunteer Moderator

2021-11-15T16:45:12.45+00:00

Are you facing this issue in the Windows 11?
Did you installed any new program before this problem started?
Is your device part of domain or company's network?
GREG ROBERTS 1 Reputation point

2021-11-15T16:50:41.223+00:00

Thanks for this fast reply!!

This event was present before I upgraded to Win 11.

No new programs added.

Not part of a domain or company network.
GREG ROBERTS 1 Reputation point

2021-11-15T16:55:58.36+00:00

Thanks for this fast reply!!

This event was present before I upgraded to Win 11.
No new programs added.
Not part of a domain or company network.
Reza-Ameri 17,341 Reputation points Volunteer Moderator

2021-11-15T16:59:16.5+00:00

Are you seeing this message only inside the Event Viewer?
Are you facing this issue with any other application?
You may report this issue using the Feedback Hub app.

Answer 1

Michael Taylor 60,346

It happens. Certs are only good for a while and then they expire. You should determine who (if anyone ) is using the cert. Go to the certificates app and find the certificate. Given that the expiration date has expired it is probably easiest to scan the list (probably under your person account) for expired certs. If the cert was generated by your IT group then talk to them about removing the old cert. If it is related to an app you run (like Fiddler) then check in that app to refresh the cert.

If the cert is provided by MS then one of their updates should renew or replace the cert.

Alternatively you can use Powershell to find the cert by its thumbprint (given in the error).

Get-ChildItem cert:\*<thumbprint> -recurse | Select-Object -Property Subject, NotAfter

GREG ROBERTS 1 Reputation point

2021-11-15T19:09:00.3+00:00

cooldadtx,

I tried Powershell.

PS C:\WINDOWS\system32> Get-ChildItem CERT:*70c4c2a62bf334e2c874985651f6a4bfa8c6e721 -recurse | Select-Object -Property Subject, NotAfter

Subject NotAfter

CN=F900D1C484A9F799 9/11/2021 9:01:21 AM

Did I type in the command and what does the result mean?
Michael Taylor 60,346 Reputation points

2021-11-15T19:18:45.427+00:00

Yes you found the cert. Your certificate expired on (I'm guessing) 9 Nov 2021. The common name is F900D... That looks like an auto-generated certificate. You should be able to find that certificate in the Certificates tool and look at the details. Hopefully it'll tell you where the cert came from.

If it is an MS cert then ensure you've applied your Windows updates. If it is from an app then you'll need to check with the app. If you cannot find any references then you might just delete it. If anybody is using it then they will start to fail but they should be failing with an expired cert anyway. IN the Event Viewer with the error message does it indicate who the app was?
GREG ROBERTS 1 Reputation point

2021-11-15T20:21:12.533+00:00
Cooldadtx,

I found the cert. under:
Personal
Certificates
F900D1C484A9F799 XBL Client IPsec Issuing CA 9/11/2021 Client Authentication, IP security end system

Opening the certificate states it has expired and that I have a private key that corresponds to this certificate (I don’t know what a private key is).

Clicking the Details tab says the key usage value is Digital Signature, Key Encipherment, Certificate Signing, Off-line CRL Signing, CRL Signing (a6)

Text from Event Viewer:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>
<Provider Name="Microsoft-Windows-CertificateServicesClient-AutoEnrollment" Guid="{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}" EventSourceName="AutoEnrollment" />
<EventID Qualifiers="32768">64</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2021-11-15T16:43:52.0606627Z" />
<EventRecordID>1510</EventRecordID>
<Correlation />
<Execution ProcessID="14672" ThreadID="0" />
<Channel>Application</Channel>
<Computer>DESKTOP-LA1JCF9</Computer>
<Security />
</System>

<EventData>
<Data Name="Context">local system</Data>
<Data Name="ObjId">70 c4 c2 a6 2b f3 34 e2 c8 74 98 56 51 f6 a4 bf a8 c6 e7 21</Data>
</EventData>
</Event

Notes:
• This computer is used for mostly for AutoCad and Email.
• It is not connected to any other computers – it should not have remote access.
• Nobody should have access except me.
Michael Taylor 60,346 Reputation points

2021-11-15T20:31:41.067+00:00

Given the name of XBL Client this looks like the validation cert for XBox Live. I would recommend that you ensure your Windows Updates have run and then ensure in Microsoft Store that it has updated all the MS-provided apps which would include the XBox Live tools. At that point the cert should be updated I would believe.
GREG ROBERTS 1 Reputation point

2021-11-15T20:58:21.323+00:00

I don't use Xbox and have everything turned off. I'll turn everything back on and run an update.
Michael Taylor 60,346 Reputation points

2021-11-15T21:25:50.97+00:00

You cannot remove all the XBox services in Windows 10. Even on a business machine they are there, unfortunately.

Share via

What to do about and expired or about to expire certificate

1 answer

Your answer