Remove-DbaComputerCertificate

Synopsis

Removes certificates from Windows certificate stores on local or remote computers

Description

Removes certificates from Windows certificate stores on local or remote computers using PowerShell remoting. This is essential for managing SSL/TLS certificates used by SQL Server instances for encrypted connections and authentication. DBAs commonly use this to clean up expired certificates, remove compromised certificates during security incidents, or manage certificate lifecycle during SQL Server migrations and decommissions. The function targets specific certificates by thumbprint and can work across multiple certificate stores and folders.

Removing a certificate from a store leaves its private key on disk, as the certificate console does. With -DeleteKey the private key is deleted as well, unless another certificate in the LocalMachine store or in the CurrentUser store of the account running the command still uses it.

Syntax

Remove-DbaComputerCertificate
    [[-ComputerName] <DbaInstanceParameter[]>]
    [[-Credential] <PSCredential>]
    [-Thumbprint] <String[]>
    [[-Store] <String>]
    [[-Folder] <String>]
    [-DeleteKey]
    [-EnableException]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Examples

Example 1: Removes certificate with thumbprint C2BBE81A94FEE7A26FFF86C2DFDAF6BFD28C6C94 in the LocalMachine store on...

PS C:\> Remove-DbaComputerCertificate -ComputerName Server1 -Thumbprint C2BBE81A94FEE7A26FFF86C2DFDAF6BFD28C6C94

Removes certificate with thumbprint C2BBE81A94FEE7A26FFF86C2DFDAF6BFD28C6C94 in the LocalMachine store on Server1

Example 2: Removes certificate using the pipeline

PS C:\> Get-DbaComputerCertificate | Where-Object Thumbprint -eq E0A071E387396723C45E92D42B2D497C6A182340 | Remove-DbaComputerCertificate

Example 3: Removes certificate with thumbprint C2BBE81A94FEE7A26FFF86C2DFDAF6BFD28C6C94 in the User\My (Personal) store...

PS C:\> Remove-DbaComputerCertificate -ComputerName Server1 -Thumbprint C2BBE81A94FEE7A26FFF86C2DFDAF6BFD28C6C94 -Store User -Folder My

Removes certificate with thumbprint C2BBE81A94FEE7A26FFF86C2DFDAF6BFD28C6C94 in the User\My (Personal) store on Server1

Example 4: Removes the certificate from the LocalMachine\My store on Server1 and deletes its private key, unless another...

PS C:\> Remove-DbaComputerCertificate -ComputerName Server1 -Thumbprint C2BBE81A94FEE7A26FFF86C2DFDAF6BFD28C6C94 -DeleteKey

Removes the certificate from the LocalMachine\My store on Server1 and deletes its private key, unless another certificate on Server1 still uses that key

Required Parameters

-Thumbprint

Specifies the unique thumbprint(s) of the certificate(s) to remove. This is the SHA-1 hash that uniquely identifies each certificate.
Use Get-DbaComputerCertificate to find thumbprints of certificates you want to remove, commonly needed when cleaning up expired SSL certificates or removing compromised certificates.
An archived certificate, which the certificate console and Get-DbaComputerCertificate hide, is removed as well when its thumbprint is given.

Optional Parameters

-ComputerName

Specifies the target computer(s) where certificates will be removed. Defaults to localhost.
Use this when managing SSL certificates across multiple SQL Server instances or cleaning up certificates on remote servers during migrations.

-Credential

Allows you to login to $ComputerName using alternative credentials

-Store

Specifies the certificate store location where certificates will be removed. Defaults to LocalMachine.
Use LocalMachine for system-wide certificates (typical for SQL Server SSL certificates) or CurrentUser for user-specific certificates.

-Folder

Specifies the certificate store folder (subfolder) where certificates will be removed. Defaults to ‘My’ (Personal certificates).
Common folders include ‘My’ for SSL certificates used by SQL Server, ‘Root’ for trusted root certificates, or ‘TrustedPeople’ for trusted person certificates.

-DeleteKey

Deletes the private key of the certificate together with the certificate, like the DeleteKey switch of the Cert: drive in Windows PowerShell.
Works for keys in a legacy Cryptographic Service Provider (what New-DbaComputerCertificate creates) and in a Key Storage Provider (CNG).
Before the key is deleted, every folder of the LocalMachine store and of the CurrentUser store of the account running the command is checked for another certificate that still uses the key, archived
certificates included, for example a copy of the certificate in another folder (WebHosting and custom folders included) or in the other store, or a renewed certificate that reused the key. If one
exists the key is kept and the output says which one.
Another certificate is recognized by the key reference stored with it: the provider, the key container and whether the key is a machine key. That reference is read from the certificate, so no private
key of another certificate is opened; a smart card certificate in the store of the user would otherwise prompt for the card. A certificate that holds the same key in a container of its own, for
example the same PFX file imported once for the machine and once for the user, does not keep the key, because deleting one container leaves the other one intact.
The key is also kept when a folder of either store cannot be read, because then it is unknown whether a certificate in that folder uses the key; the output names the folder.
A legacy Cryptographic Service Provider container can hold a key exchange key and a signature key and can only be deleted as a whole, so it is kept when a certificate still uses the other key; the
output names that certificate.
The personal stores of other accounts on the computer cannot be checked, because they are only available to those accounts. A key that only a certificate in one of them still uses is deleted.

-EnableException

By default, when something goes wrong we try to catch it, interpret it and give you a friendly warning message.
This avoids overwhelming you with “sea of red” exceptions, but is inconvenient because it basically disables advanced scripting.
Using this switch turns this “nice by default” feature off and enables you to catch exceptions with your own try/catch.

-WhatIf

Shows what would happen if the command were to run. No actions are actually performed.

-Confirm

Prompts you for confirmation before executing any changing operations within the command.

Outputs

PSCustomObject

Returns one object per certificate removal attempt. Each object contains the following properties:

• ComputerName: The computer name where the certificate removal was attempted
• Store: The certificate store location (LocalMachine or CurrentUser)
• Folder: The certificate store folder/subfolder where the certificate was located (My, Root, TrustedPeople, etc.)
• Thumbprint: The SHA-1 hash thumbprint of the certificate that was targeted for removal
• Status: The status of the removal operation. Shows “Removed” on success, or “Certificate not found in Cert:$Store$Folder” if the certificate was not found
• PrivateKey: What happened to the private key. “Kept” without -DeleteKey, “Deleted” with -DeleteKey, “Kept, shared with in ” when another certificate still uses the key, “Kept, key container shared with in ” when a certificate still uses the other key of a legacy container, “Not deleted: ” when the deletion failed, “None” when the certificate has no private key, $null when the certificate was not found