In DOS, type

certutil -config – -ping

 

 

Next post will probably be – how to remove legacy CA in domain that looks like it was deleted back in 2009.