asked on Some questions about certificates on an SBS 2011 standard server. Which are needed? Which should be deleted?
On an SBS 2011 standard server, I was having problems getting a new user working on ios (but outlook 2016 worked fine and other existing users set up fine on the phone)..
I started playing with the microsoft connectivity tester and it was failing with certificate errors.
Troubleshooting some error numbers, I see pages talking about checking the certificates.
Looking in the certificate snap in, there's this user and this machine choices. looking in there, there's LOADS of certs. some expired. some YEARS away from expiration (affirm Trust Premium ECC with exp 12/31/2040 is the farthest out in trusted root certs), there's trusted root cert authories, third party trusted root certs. 'all' we use the server for is exchange and file server. Yeah, I use server/remote and server/owa... the users don't.
Can I blindly delete the expired certs (some I think are self signed) we do have a comodo cert that expires in 1 1/2 years. There were godaddy certs - I think we had that before the comodo. and other certs from companies I don't know about. They come with the server? (again it's SBS 2011).
And there's untrusted certs like diginotar Root CA G2 expiring in 2029).
Is there a list of what I can / should delete or keep? Just to reduce clutter? I just know about the comodo cert we bought. these others? No clue.
THere's a */EFGO.GOV.TR cert expiring in 2021. We are a US based company / don't do anything with other countries... ok, I see something about google / fruadulent certs and I can / should delete that one?
Do I just google each one to see what I find? Is there a way to delete all except the comodo and import a current / clean set of trusted root cert authority cert?
THANKS!
I started playing with the microsoft connectivity tester and it was failing with certificate errors.
Troubleshooting some error numbers, I see pages talking about checking the certificates.
Looking in the certificate snap in, there's this user and this machine choices. looking in there, there's LOADS of certs. some expired. some YEARS away from expiration (affirm Trust Premium ECC with exp 12/31/2040 is the farthest out in trusted root certs), there's trusted root cert authories, third party trusted root certs. 'all' we use the server for is exchange and file server. Yeah, I use server/remote and server/owa... the users don't.
Can I blindly delete the expired certs (some I think are self signed) we do have a comodo cert that expires in 1 1/2 years. There were godaddy certs - I think we had that before the comodo. and other certs from companies I don't know about. They come with the server? (again it's SBS 2011).
And there's untrusted certs like diginotar Root CA G2 expiring in 2029).
Is there a list of what I can / should delete or keep? Just to reduce clutter? I just know about the comodo cert we bought. these others? No clue.
THere's a */EFGO.GOV.TR cert expiring in 2021. We are a US based company / don't do anything with other countries... ok, I see something about google / fruadulent certs and I can / should delete that one?
Do I just google each one to see what I find? Is there a way to delete all except the comodo and import a current / clean set of trusted root cert authority cert?
THANKS!
SBSSSL / HTTPSWindows Server 2012Windows Server 2008Security
Last Comment
David Johnson, CD
ASKER CERTIFIED SOLUTION
Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a questionASKER
David: I'd rather not fiddle with them - a little knowledge is dangerous... But for troubleshooting email cert issues, being obsessive, and wanting (needing) to learn things, I feel I need to deal with this.
Sajid: Right click the certificate you’d like to remove and click delete
thoughts on which other than expired ones that I should keep /delete? I guess I should list them / screen capture and see if anyoine here sees glaring red flags / ones I should make sure not to touch.
Sajid: Right click the certificate you’d like to remove and click delete
thoughts on which other than expired ones that I should keep /delete? I guess I should list them / screen capture and see if anyoine here sees glaring red flags / ones I should make sure not to touch.
Email Certificate issues: the problem is in the email configuration not the certificate store.
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
We are a US based company / don't do anything with other countries You don't have customers worldwide? You have absolutely no control over other sites and where they source their certificates they could have got a really good price from the hong kong post office CA