58

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete.

Why does a fresh install of Windows Server 2012 R2 come with certificates such as these:

Expired Certs

Considering that these certificates expired back when I was in high school, what could they possibly be good for? Why would they still be included with the operating system 15 years later?

  • 3
    Isn't it because of old device drivers? – mincewind Dec 17 '14 at 9:26
64

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed.

Source: http://support.microsoft.com/kb/293781

Some certificates that are listed in the previous tables have expired. However, these certificates are necessary for backward compatibility. Even if there is an expired trusted root certificate, anything that was signed by using that certificate before the expiration date requires that the trusted root certificate be validated. As long as expired certificates are not revoked, they can be used to validate anything that was signed before their expiration.

  • 5
    I'm going to do something crazy and delete the certificates from the 20th century. I don't believe I'm using any arcane stone-age kernel drivers, so I bet I'll be OK... – Ryan Ries Dec 17 '14 at 4:56
  • 5
    @RyanRies seems reasonable; worst case if you do find a legacy app that needs them, you can always add the cert back. – Dan Neely Dec 17 '14 at 5:15
  • 6
    @Cthulhu if they signed something before they were expired then that makes that signature valid, according to Microsoft – MDMoore313 Dec 17 '14 at 15:11
  • 13
    Not only Microsoft but all standard conforming certificate validation! (Only for counter-signed timestamps, obviously). It only makes sense this way. A certificate confirms the identity of someone. If he signed something with a valid certificate a year ago, it is still signed by the same person, even if the certificate is expired! – Josef Dec 17 '14 at 17:08
  • 3
    Don't forget to turn off Automatic Root Certificates Update via Group Policy or Local Computer Policy, or else Windows will automatically re-download these certificates and put them back in your Trusted CAs store after you've deleted them. – Ryan Ries Dec 17 '14 at 21:24
1

Some of these older Root Certificates have been used to generate 'Time Stamping' or 'Code Signing' certificates. This means a piece of executable code has been digitally signed way back. These Root Certs may still be needed, so your PC can validate that the code signing was valid AT THE TIME OF SIGNING. Which can be of course also way back.

Deleting these old certs may cause your PC to claim that an old piece of software can no longer be validated for authenticity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.