Guidance on “Unverified Insecure SSH Private Key” flagged by Defender for Cloud

[fabdulazeez]

Defender for Cloud has raised an alert: “Unverified insecure SSH Private Key.”
It appears to be pointing to the Exported Certificates folder created by Qlik Sense.

C:\ProgramData\Qlik\Sense\Repository\Exported Certificates

I would like to know:

1. How can we mitigate this alert?

2. Is it safe to delete all the folders within Exported Certificates including .Local?

3. What would be the impact on Qlik Sense services if these folders are deleted?

4. Is there an alternative approach (e.g., securing or relocating the keys) instead of deletion?

We have a single node Qlik sense Enterprise on Windows may 2025 version on azure VM.

[Daniele_Purrone · Accepted solution]

Hi @fabdulazeez ,

those certificates are not explicitly used by Qlik Sense Enterprise during its activity.

They are just exports that are usually manually created by the administrators when needed for third party purposes (like API calls).
See https://community.qlik.com/t5/Official-Support-Articles/Export-client-certificate-and-root-certifica... and https://help.qlik.com/en-US/sense-admin/May2025/Subsystems/DeployAdministerQSE/Content/Sense_DeployA...

Once the certificates have been properly reimported for use by third party tools or the user making the API calls, they can be deleted or stored in another safe location. They can also be re-exported to the same folder in any moment, if needed.

I hope this clarifies it!

Daniele

[fabdulazeez]

Is it same for the ".Local Certificates" folder ?

[Daniele_Purrone]

Yes. None of the certificates used in "Exported Certificates" are actively used.

If you want to be safe, you can zip the folders and store them somewhere else.