I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete.

Why does a fresh install of Windows Server 2012 R2 come with certificates such as these:



Considering that these certificates expired back when I was in high school, what could they possibly be good for?  Why would they still be included with the operating system 15 years later?

In essence, these certificates are necessary and required for backward compatibility with XP and Server 2003. If anything was signed with these certificates, even if they're expired now, your server needs the cert trusted in order to trust the thing that the cert signed.

Source: http://support.microsoft.com/kb/293781


  Some certificates that are listed in the previous tables have expired. However, these certificates are necessary for backward compatibility. Even if there is an expired trusted root certificate, anything that was signed by using that certificate before the expiration date requires that the trusted root certificate be validated. As long as expired certificates are not revoked, they can be used to validate anything that was signed before their expiration.

