Remove Certificate
Removes a certificate from a Windows certificate store. The certificate can be selected either by its thumbprint or by its subject.\n\nBecause removing a certificate can break trust on the device, the brick only removes more than one certificate when you explicitly allow it, and it never empties a store that holds more than one certificate.
Parameters
Section titled “Parameters”Thumbprint
Section titled “Thumbprint”Optional
The thumbprint of the certificate to remove. This is the safest way to target a single certificate.\n\nYou can paste the value directly from the certificate details window - spaces and separators are removed automatically.\n\nExample:\na9 09 50 2d d8 2a e4 14 33 e6 f8 38 86 b0 0d 42 77 a3 2a 7b\n\nLeave empty to select the certificate by its subject instead. Either Thumbprint or Subject must be filled in. If both are filled in, the thumbprint is used.
Subject
Section titled “Subject”Optional
The subject of the certificate to remove, used as an alternative to the thumbprint. Wildcards must be written out, so use CN=Contoso Issuing CA* rather than only part of the name.\n\nExample:\nCN=Contoso Issuing CA, O=Contoso, C=DK\n\nA subject that is too general is refused, so values such as * or CN=* will not remove anything. Leave empty when a thumbprint is supplied.
Store Location
Section titled “Store Location”Required — Default: Local Machine (all users)
Select where the certificate is installed. Local Machine covers every user on the device and is where certificates deployed by IT are normally placed. This is the right choice in almost every case.\n\nSystem Account is not the store of the person signed in to the device. The job always runs as the built-in system account of the device, and this option means that account’s own private store, which no signed-in user can see or reach. Choose it only for a certificate that a service or a scheduled task running as the system account placed there itself.\n\nIf you choose System Account to clean up a certificate you can see while signed in, nothing is found, nothing is removed, and the job still reports success. Select Local Machine instead. Allowed values: Local Machine (all users), System Account (no signed-in user).
Certificate Store
Section titled “Certificate Store”Required — Default: Trusted Root Certification Authorities (Root)
Select the certificate store to remove the certificate from. It must be the same store the certificate was installed into, otherwise nothing is found.\n\nTrusted Root Certification Authorities holds root certificates, Intermediate Certification Authorities holds issuing certificates, Personal holds certificates issued to this device or user, Trusted Publishers holds code signing certificates, and Trusted People holds certificates for individually trusted people or devices. Allowed values: Trusted Root Certification Authorities (Root), Intermediate Certification Authorities (CA), Personal (My), Trusted Publishers (TrustedPublisher), Trusted People (TrustedPeople).
Continue If Not Found
Section titled “Continue If Not Found”Required — Default: True
Enable to let the job continue when the certificate is not installed. This is the recommended setting for uninstall workflows, where the certificate may already have been removed.\n\nDisable to make the job fail when the certificate cannot be found, for example when you need to know that the removal actually happened.
Allow Multiple Matches
Section titled “Allow Multiple Matches”Required — Default: False
Enable to allow a subject to remove more than one certificate, for example when several certificates from the same issuer must go.\n\nKeep it disabled to stop the job when the subject matches more than one certificate, which protects against removing certificates you did not intend to. Even when enabled, a subject that matches every certificate in a store holding more than one certificate is refused, so a store can never be emptied by a single subject.
Details
Section titled “Details”- Category: System
- Brick ID:
Certificate-Remove
{ "category": "system", "description": "Removes a certificate from a Windows certificate store. The certificate can be selected either by its thumbprint or by its subject.\\n\\nBecause removing a certificate can break trust on the device, the brick only removes more than one certificate when you explicitly allow it, and it never empties a store that holds more than one certificate.", "developerVendor": "CapaSystems A/S", "displayName": null, "id": "Certificate-Remove", "name": "Remove Certificate", "parameters": [ { "allowManualInput": false, "defaultValue": "", "defaultValueObject": null, "description": "The thumbprint of the certificate to remove. This is the safest way to target a single certificate.\\n\\nYou can paste the value directly from the certificate details window - spaces and separators are removed automatically.\\n\\nExample:\\na9 09 50 2d d8 2a e4 14 33 e6 f8 38 86 b0 0d 42 77 a3 2a 7b\\n\\nLeave empty to select the certificate by its subject instead. Either Thumbprint or Subject must be filled in. If both are filled in, the thumbprint is used.", "id": "Thumbprint", "name": "Thumbprint", "regExValidation": "^$|^(?:[^0-9a-fA-F]*[0-9a-fA-F]){40}[^0-9a-fA-F]*$|^(?:[^0-9a-fA-F]*[0-9a-fA-F]){64}[^0-9a-fA-F]*$", "required": false, "type": "TextBox", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "", "defaultValueObject": null, "description": "The subject of the certificate to remove, used as an alternative to the thumbprint. Wildcards must be written out, so use CN=Contoso Issuing CA* rather than only part of the name.\\n\\nExample:\\nCN=Contoso Issuing CA, O=Contoso, C=DK\\n\\nA subject that is too general is refused, so values such as * or CN=* will not remove anything. Leave empty when a thumbprint is supplied.", "id": "Subject", "name": "Subject", "regExValidation": "", "required": false, "type": "TextBox", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": null, "defaultValueObject": { "id": "LocalMachine", "name": "Local Machine (all users)" }, "description": "Select where the certificate is installed. Local Machine covers every user on the device and is where certificates deployed by IT are normally placed. This is the right choice in almost every case.\\n\\nSystem Account is not the store of the person signed in to the device. The job always runs as the built-in system account of the device, and this option means that account's own private store, which no signed-in user can see or reach. Choose it only for a certificate that a service or a scheduled task running as the system account placed there itself.\\n\\nIf you choose System Account to clean up a certificate you can see while signed in, nothing is found, nothing is removed, and the job still reports success. Select Local Machine instead.", "id": "StoreLocation", "name": "Store Location", "regExValidation": "", "required": true, "type": "ComboBox", "value": null, "values": [], "valuesObject": [ { "id": "LocalMachine", "name": "Local Machine (all users)" }, { "id": "CurrentUser", "name": "System Account (no signed-in user)" } ] }, { "allowManualInput": false, "defaultValue": null, "defaultValueObject": { "id": "Root", "name": "Trusted Root Certification Authorities (Root)" }, "description": "Select the certificate store to remove the certificate from. It must be the same store the certificate was installed into, otherwise nothing is found.\\n\\nTrusted Root Certification Authorities holds root certificates, Intermediate Certification Authorities holds issuing certificates, Personal holds certificates issued to this device or user, Trusted Publishers holds code signing certificates, and Trusted People holds certificates for individually trusted people or devices.", "id": "StoreName", "name": "Certificate Store", "regExValidation": "", "required": true, "type": "ComboBox", "value": null, "values": [], "valuesObject": [ { "id": "Root", "name": "Trusted Root Certification Authorities (Root)" }, { "id": "CA", "name": "Intermediate Certification Authorities (CA)" }, { "id": "My", "name": "Personal (My)" }, { "id": "TrustedPublisher", "name": "Trusted Publishers (TrustedPublisher)" }, { "id": "TrustedPeople", "name": "Trusted People (TrustedPeople)" } ] }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Enable to let the job continue when the certificate is not installed. This is the recommended setting for uninstall workflows, where the certificate may already have been removed.\\n\\nDisable to make the job fail when the certificate cannot be found, for example when you need to know that the removal actually happened.", "id": "ContinueIfNotFound", "name": "Continue If Not Found", "regExValidation": "", "required": true, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "False", "defaultValueObject": null, "description": "Enable to allow a subject to remove more than one certificate, for example when several certificates from the same issuer must go.\\n\\nKeep it disabled to stop the job when the subject matches more than one certificate, which protects against removing certificates you did not intend to. Even when enabled, a subject that matches every certificate in a store holding more than one certificate is refused, so a store can never be emptied by a single subject.", "id": "AllowMultipleMatches", "name": "Allow Multiple Matches", "regExValidation": "", "required": true, "type": "Boolean", "value": null, "values": [], "valuesObject": null } ], "powershell": { "base64Encoded": true, "function": "ZnVuY3Rpb2..." }, "type": "powerbrick", "version": "2026.10.8.1"}