59

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete.

Why does a fresh install of Windows Server 2012 R2 come with certificates such as these:

Expired Certs

Considering that these certificates expired back when I was in high school, what could they possibly be good for? Why would they still be included with the operating system 15 years later?

Improve this question
1
  • 3
    Isn't it because of old device drivers?
    – mincewind
    Dec 17, 2014 at 9:26

2 Answers 2

Reset to default
64

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed.

Source: http://support.microsoft.com/kb/293781

Some certificates that are listed in the previous tables have expired. However, these certificates are necessary for backward compatibility. Even if there is an expired trusted root certificate, anything that was signed by using that certificate before the expiration date requires that the trusted root certificate be validated. As long as expired certificates are not revoked, they can be used to validate anything that was signed before their expiration.

Improve this answer
13
  • 5
    I'm going to do something crazy and delete the certificates from the 20th century. I don't believe I'm using any arcane stone-age kernel drivers, so I bet I'll be OK...
    – Ryan Ries
    Dec 17, 2014 at 4:56
  • 5
    @RyanRies seems reasonable; worst case if you do find a legacy app that needs them, you can always add the cert back.
    – Dan Is Fiddling By Firelight
    Dec 17, 2014 at 5:15
  • 6
    @Cthulhu if they signed something before they were expired then that makes that signature valid, according to Microsoft
    – MDMoore313
    Dec 17, 2014 at 15:11
  • 14
    Not only Microsoft but all standard conforming certificate validation! (Only for counter-signed timestamps, obviously). It only makes sense this way. A certificate confirms the identity of someone. If he signed something with a valid certificate a year ago, it is still signed by the same person, even if the certificate is expired!
    – Josef
    Dec 17, 2014 at 17:08
  • 3
    Don't forget to turn off Automatic Root Certificates Update via Group Policy or Local Computer Policy, or else Windows will automatically re-download these certificates and put them back in your Trusted CAs store after you've deleted them.
    – Ryan Ries
    Dec 17, 2014 at 21:24
1

Some of these older Root Certificates have been used to generate 'Time Stamping' or 'Code Signing' certificates. This means a piece of executable code has been digitally signed way back. These Root Certs may still be needed, so your PC can validate that the code signing was valid AT THE TIME OF SIGNING. Which can be of course also way back.

Deleting these old certs may cause your PC to claim that an old piece of software can no longer be validated for authenticity.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .