Certificate Manager (certmgr.msc)

2 min readArticle

Run: certmgr.msc (current user) or certlm.msc (local machine / all users)

Manages digital certificates and the PKI trust infrastructure that underpins HTTPS, EFS, code signing, email encryption (S/MIME), and smart card authentication. The distinction between user-context and machine-context stores matters — browser TLS validation uses the machine store, while user-specific operations like email signing use the user store.

Certificate Stores

Store	Purpose
Personal	Your certificates with associated private keys
Trusted Root CAs	Root certificates — trusting here means trusting that CA for ALL purposes
Intermediate CAs	Intermediate certificates in the chain
Trusted Publishers	Code signing certs for software publishers
Untrusted Certificates	Explicitly revoked or blocked certificates

Key Operations

cmd

# Import root CA to machine store (elevated)
certutil -addstore "Root" certificate.cer

# Import PFX (with private key)
certutil -importpfx certificate.pfx

# Verify certificate chain including CRL/OCSP
certutil -verify -urlfetch certificate.cer

# Export certificate thumbprints from local machine root store
certutil -store Root

powershell

# List all certs in machine root store
Get-ChildItem Cert:\LocalMachine\Root | Select Subject, Thumbprint, NotAfter | Sort Subject

# Find expiring certs within 30 days
Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.NotAfter -lt (Get-Date).AddDays(30) }

Security Relevance

Rogue root CA installation is catastrophic. An attacker who adds a root CA to Trusted Root Certification Authorities can issue any certificate they want — enabling transparent HTTPS interception (MITM) with no browser warning. This is exactly what corporate SSL inspection proxies do legitimately, which is why it is also a known malware technique.

Regularly audit Trusted Root CAs and compare against known-good baselines. Any unexpected CA in the root store warrants immediate investigation. Enterprise environments should push approved root CAs via GPO rather than manual installation.

techzonesite.comUnlock Your IT Potential