Section 7.1.3. How to Remove a Root CA Certificate (2024)

FAQs

How do I remove a certificate from CA root? ›

The system lists the unique identifiers (chains) of the certificates in the trusted root store. Retrieve the certificate you want to delete. To retrieve and verify a root certificate, use its unique identifier (chain). Delete the certificate by providing its unique identifier (chain).

Press Windows Key + R Key together, type certmgr. msc, and hit enter. You will get a new window with the list of Certificates installed on your computer. Locate the certificate you want to delete and then click on the Action button then, click on Delete.

Select the Content Tab and select the Certificates button. In the Certificates window, select all of the certs and select remove.

Click Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities. Select Trusted Root Certification Authorities, right click, and select Import to open the Certificate Import Wizard. Click Next on the Welcome screen.

The root certificate, often called a trusted root, is at the center of the trust model that secures Public Key Infrastructure (PKI). Every device includes a so-called root store.

Can root certificates be revoked? ›

You can't revoke a trusted (e.g. Root CA) certificate, because it is self-signed by the CA and therefore there is no trusted mechanism by which to verify a CRL. If a root CA is compromised it is very bad :-).

– Windows: Go to the Control Panel, locate the “Programs and Features” or “Uninstall a Program” section, find Charles in the list of installed programs, click on it and then select “Uninstall”.

Click on the View Certificates button. Select the Authorities tab, and look for the Root Certificate that you would like to delete. Select the certificate and click the Delete or Distrust button. In the resulting dialogue, select the correct Root Certificate and then click OK.

Expand Services, expand Public Key Services, and then select the AIA folder. In the right pane, right-click the CertificationAuthority object for your CA, select Delete, and then select Yes. In the left pane of the Active Directory Sites and Services MMC snap-in, select the CDP folder.

Under Related Items, click Key stores and certificates. Click a <keystore name> to which you want to add the new CA certificate. Under Additional Properties, click Personal certificates to list the personal certificates. Click the Revoke button.

Any expired and not in use certificates should be removed to avoid certificate related alarms. Force a refresh of VECS by running the following command. This will ensure updates are pushed to the other PSCs in the environment if there is more than one. Confirm that the Certificate is no longer present.

Locate and right-click on the certificate you wish to remove. Click on Properties and then in the General tab, click on Disable all purposes for this certificate in the Certificate purposes section. Hit Apply and restart your server to complete the removal process.