Expired certificate keeps re-appearing a few minutes after it is deleted

Hello,

Thank you so much for posting here.

Would you please help to collect more information for us to narrow down the issue?

1: How is the old SQL server certificate is created? Is it automatically enrolled?
2: Each time the deleted certificate would re-appear a few minutes later after we tried to delete it? That is to say, no matter how many times we tried to delete it, it would re-appear a few minutes later. Is my understanding correct?
3: Is the re=appear certificate totally the same with the deleted one? Do they have the same expire date?

If there are any concerns about the information above, please feel free to contact me. Thanks for your understanding.

Best regards,
Hannah Xiong

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Hi HannahXiong-MSFT

1) The certificate was created using the steps under “Install on a single server” and “Configure server” located here:

enable-encrypted-connections-to-the-database-engine

2) You are correct.
3) The deleted certificate that re-appears is totally the same with the same expiration date of 10/4/2020.

Hello PaulSalotti-4196,

Thank you so much for your kindly reply.

Frankly speaking, we are not professional with SQL server. So sorry that we could not reproduce this issue.

As per my understanding and experience, if we configure certificate auto-enrollment via group policy, the certificate will re-appear after group policy refresh if we delete it. For example:

I configured user certificate auto-enrollment. Then I deleted this user certificate. After running gpupdate /force, the certificate comes back with the same expiration date.

Reference about configuring certificate auto-enrollment: https://video2.skills-academy.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-server-certificate-autoenrollment

It is suggested that we could run gpresult /h C:\report.html to get the GPO report to check whether we have configured such policy.

Thank you so much for your understanding and support.

Best regards,
Hannah Xiong

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.