> # Deleting Certificates from the CA Configuration

> You can delete the identity certificates and CA certificates that are configured in a trust point. You must first delete the identity certificate, followed by the CA certificates. After deleting the identity certificate, you can disassociate the RSA key-pair from a trust point. The certificate deletion is necessary to remove expired or revoked certificates, certificates whose key-pairs are compromised (or suspected to be compromised) or CAs that are no longer trusted.

> ## Detailed Steps

> To delete the CA certificate (or the entire chain in the case of a subordinate CA) from a trust point using DCNM-SAN, follow these steps:

> 1. Click Switches > Security > PKI in the Physical Attributes pane.
> 2. Click the Trust Point Actions tab in the Information pane.
> 3. Select the cadelete option from the Command drop-down menu to delete the identity certificate from a trust point.

> Note If the identity certificate being deleted is the last-most or only identity certificate in the device, you must use the forcecertdelete action to delete it. This ensures that the administrator does not mistakenly delete the last-most or only identity certificate and leave the applications (such as IKE and SSH) without a certificate to use.

> 4. Click Apply Changes to save the changes.

> To delete the identity certificate, click the Trust Point Actions tab and select the certdelete or forcecertdelete in the Command drop-down menu.

> Copyright 2010-2015, Cisco Systems, Inc. All rights reserved.