I connect to some remote web services that require a client certificate for authentication. Using certain tools (eg. SOAPUI), I can specify the certificate directly, but when doing quick requests to check a service is up, I usually use IE.

IE requires for me to have one or more client certificates installed against my user, which - when installed - works fine.

However, it seems that my client certs are getting removed, at least weekly. It is a simple enough task to re-install them, but given our Support team have stated that they are not aware of any automated operations that would remove these certificates, this shouldn't really be necessary.

A couple of colleagues have installed the same certs against their profiles and they have not had the same issue.

So I need to somehow track down what is doing this; the question is, how do I do this?

Is there something I can set that will make this visible in the event viewer, or would this be visible by default? Is there a third party tool that could help me?


The Microsoft article Certificate Services Lifecycle Notifications describes the following in its Event Viewer section:

Starting in Windows 8 and Windows Server 2012, two new event logs have been added to allow for certificate services lifecycle events. These new logs are located in the Event Viewer application under Applications and Service Logs , Microsoft, Windows as:

  • CertificateServicesClient-Lifecycle-System
  • CertificateServicesClient-Lifecycle-User

Each log has a subordinate Operational log where the certificate services events are recorded.

You may find these logs by following this path in the Event Viewer :
Applications and Services Logs -> Microsoft -> Windows.

If this works for you, you may find information about the certificate removal in a Deleted event or in another similar event.

  • I'm afraid I'd already scouted out the event viewer, but those two logs are not present on my system. I've looked to see if they need to be enabled somehow but not success so far. – CJM May 26 '17 at 13:33
  • Which version of Windows? – harrymc May 26 '17 at 15:01
  • Server 2008 R2 Standard – CJM May 30 '17 at 11:40
  • 1
    2008 R2 is is too old for this log. Then this answer may pertain: "3rd party root CA's can be deleted by Windows if they are not recognized". It might be that the computer is lacking this trusted certificate authority (CA). Not recommended, but as described here you could disable Windows automatic root certificates: Run gpedit.msc -> Administrative Templates -> System -> Internet Communication Management -> Internet Communication settings and disable “Turn off Automatic Root Certificates Update”. – harrymc May 30 '17 at 12:52
  • Ironically the root cert (upon which the certificate chain is trusted) is not removed. Furthermore, a colleague installed exactly the same client cert on his account on the same machine, and his does not get deleted. – CJM May 30 '17 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.