I'm rebuilding several domain controllers in a messy environment and found an old Trusted Root CA certificate still being published to domain-joined servers and desktops. The certificate authority was decommissioned in 2021, and all certificates it issued expired around then. I can't find a GPO or script distributing the certificate, so it appears to be stored directly in Active Directory, including the Public Key Services containers visible through ADSI Edit. The CA was apparently associated with an old remote-management and software-deployment system, but I don't believe anything still depends on it. I also found a backup of the CA's private key from the decommissioning process. Would running `certutil -dsdelca` be safe, or are there other locations and dependencies I should check first?
3 Answers
Expired certificates may no longer authenticate new connections, but the CA certificate can still matter when validating old signatures, encrypted files, archived documents, or other historical data. Before deleting it, document where it is published, export the certificate and private key, and confirm that no systems need to validate data issued by it. Having the private key backup gives you a recovery option, but restoring the CA later is not a substitute for checking dependencies first.
First identify and remove whatever is publishing the certificate to client machines. Check Group Policy, startup scripts, management tools, and certificate auto-enrollment settings. If the certificate is only being distributed by a GPO, remove it there rather than starting with the AD CA object. Also keep backups of the certificate and relevant directory data before making changes.
I couldn't find a GPO or script distributing it, so the remaining copies seem to be in Active Directory itself.
An enterprise CA publishes several objects directly into Active Directory. In ADSI Edit, review the Configuration partition under Services > Public Key Services, including the AIA, Certification Authorities, KRA, and NTAuthCA containers. Removing the CA object with `certutil -dsdelca` can be appropriate when the CA is permanently retired, but verify that no current certificates, smart-card authentication, code signing, S/MIME, encrypted files, or other validation workflows still depend on that CA.
Those are the locations where I found the certificate. The old CA name suggests it belonged to remote-management and software-deployment software, and I’m fairly confident it is no longer used.
I found a backup containing the private key from when the CA was decommissioned, so it should be possible to recover if an unexpected dependency turns up.