topic Re: Guidance on “Unverified Insecure SSH Private Key” flagged by Defender for Cloud in Management & Governance

Guidance on “Unverified Insecure SSH Private Key” flagged by Defender for Cloud

fabdulazeez — Tue, 16 Sep 2025 12:34:28 GMT

Defender for Cloud has raised an alert: “Unverified insecure SSH Private Key.”
It appears to be pointing to the Exported Certificates folder created by Qlik Sense.

C:\ProgramData\Qlik\Sense\Repository\Exported Certificates

I would like to know:

How can we mitigate this alert?
Is it safe to delete all the folders within Exported Certificates including .Local?
What would be the impact on Qlik Sense services if these folders are deleted?
Is there an alternative approach (e.g., securing or relocating the keys) instead of deletion?

We have a single node Qlik sense Enterprise on Windows may 2025 version on azure VM.

Re: Guidance on “Unverified Insecure SSH Private Key” flagged by Defender for Cloud

Daniele_Purrone — Tue, 16 Sep 2025 14:09:40 GMT

Hi @fabdulazeez ,

those certificates are not explicitly used by Qlik Sense Enterprise during its activity.

They are just exports that are usually manually created by the administrators when needed for third party purposes (like API calls).
See https://community.qlik.com/t5/Official-Support-Articles/Export-client-certificate-and-root-certificate-to-make-API-calls/ta-p/1715515 and https://help.qlik.com/en-US/sense-admin/May2025/Subsystems/DeployAdministerQSE/Content/Sense_DeployAdminister/QSEoW/Administer_QSEoW/Managing_QSEoW/export-certificates.htm

Once the certificates have been properly reimported for use by third party tools or the user making the API calls, they can be deleted or stored in another safe location. They can also be re-exported to the same folder in any moment, if needed.

I hope this clarifies it!

Daniele

Re: Guidance on “Unverified Insecure SSH Private Key” flagged by Defender for Cloud

fabdulazeez — Tue, 16 Sep 2025 14:18:57 GMT

Is it same for the ".Local Certificates" folder ?

Re: Guidance on “Unverified Insecure SSH Private Key” flagged by Defender for Cloud

Daniele_Purrone — Tue, 16 Sep 2025 14:41:37 GMT

Yes. None of the certificates used in "Exported Certificates" are actively used.

If you want to be safe, you can zip the folders and store them somewhere else.