Windows Certificate Store Contains an Expired Machine Certificate

Hello,

If enterprise workstations continue presenting expired machine certificates, the issue is likely related to certificate selection, failed auto-enrollment, private-key access, or incorrect certificate template permissions.

First, inspect the installed machine certificates using elevated PowerShell:

Get-ChildItem Cert:\LocalMachine\My |
Select Subject, Issuer, Thumbprint, NotAfter, HasPrivateKey, EnhancedKeyUsageList

Check whether a valid replacement certificate exists, whether it has the Client Authentication EKU (1.3.6.1.5.5.7.3.2), and whether HasPrivateKey is True.

To investigate automatic enrollment, run:

gpupdate /force
certutil -pulse

Verify that this Group Policy is enabled:

Computer Configuration > Windows Settings > Security Settings > Public Key Policies > Certificate Services Client - Auto-Enrollment

Ensure automatic renewal is enabled and the computer account has the required Read, Enroll, and Autoenroll permissions on the certificate template.

Next, check Event Viewer under:

Applications and Services Logs > Microsoft > Windows > CertificateServicesClient-AutoEnrollment

Look for renewal failures, template permission errors, and CA connectivity issues.

To inspect private-key availability in more detail, run:

certutil -store -v My <THUMBPRINT>

Remember that HasPrivateKey = True does not guarantee the authentication process has permission to use that key.

Finally, verify which certificate is actually presented during authentication. A newer certificate in the store does not guarantee that the application selects it. Check the authentication logs and compare the presented certificate's thumbprint with the installed certificates. Avoid deleting the expired certificate until the replacement has been successfully tested.

One important question: Is the authentication using 802.1X (EAP-TLS), VPN/IPsec, Wi-Fi, or IIS/HTTPS? Also, does the workstation already have a valid replacement certificate?

These details will help determine whether the problem is certificate selection or an auto-enrollment failure.

Regards,

Domic Vo.