Remove CRL from a local computer's store

i have issue 1 app (skype business, if it's matters) configured out of box local cached crls. it's still working even if cache empty spamming to the windows fabric event log. i've managed automate crls importing problem can't remove expired ones store, command works silently no errors crls still there.

this install command & it's what's intended for, install crl: certutil -addstore -enterprise -f ca c:\temp\ca1.crl

this uninstall command & it's doesn't remove crl throw errors: certutil -delstore -enterprise ca c:\ca1.crl

is there way for guaranteed crl removal through scripting?

thanks pointing me possible way, seems i've manage write script job. not best solution, maybe there's way process directly through com or .net, anyway, here's code:

clear-host

$certlist = &certutil -store -enterprise ca
$now = get-date
$marker = "================"

$pattern = (get-culture).datetimeformat.shortdatepattern + " " + (get-culture).datetimeformat.shorttimepattern

$crllist = @()
$crl = @{}
$is_crl = $false

# parse crl entries
($i=0; $i -lt $certlist.count; $i++) {
    switch -regex ($certlist[$i]) {
        "$marker crl \d{1,} $marker" {if ($is_crl) {$crllist += , $crl; $crl=@{}; } $is_crl = $true}
        "$marker certificate \d{1,} $marker" {if ($is_crl) {$crllist += , $crl; $crl=@{}; } $is_crl = $false}
        "certutil: -store command completed successfully." {$crllist += , $crl; $crl=@{}; }
        default {
            if ($is_crl) {
                $string = $certlist[$i] -split ': '
                switch ($string[0]) {
                    "issuer" {$crl.add("issuer", $string[1])}
                    " thisupdate" {$crl.add("thisupdate", [datetime]::parseexact($string[1], $pattern, $null))}
                    " nextupdate" {$crl.add("nextupdate", [datetime]::parseexact($string[1], $pattern, $null))}
                    "crl entries" {$crl.add("crlentries", $string[1])}
                    "ca version" {$crl.add("caversion", $string[1])}
                    "crl number" {$crl.add("crlnumber", ($string[1] -split "=")[1] -replace " ")}
                    "delta crl indicator" {$crl.add("deltacrlnumber", ($string[1] -split "=")[1] -replace " ")}
                    "crl hash(sha1)" {$crl.add("crlhash", $string[1]  -replace " ")}
                }
            }
        }
    }

}

#remove expired crls
$crllist | % {
    if ($_.'nextupdate' -lt $now) {& certutil -delstore -enterprise ca $_.'crlhash'}
}

also, if ever ms skype team's response on topic, please, provide here, in advance.

Windows Server  >  Security