How to change Certificate on the Windows Certificate Store

Learn how to manually replace a TLS certificate in the Windows Local Computer certificate store, preserve the private key, grant access, and verify consumers.

The Windows certificate store is a repository, not a TLS endpoint. Importing a new certificate makes it available to Windows services, but does not make IIS, RDP, SQL Server, or another application use it. Each consumer still needs its own binding or thumbprint updated.

Before you begin

Obtain a PKCS#12/PFX containing the leaf certificate and matching private key, plus its password. Import intermediate CA certificates as well when the PFX does not contain them.
Confirm the certificate has the required DNS SANs, Enhanced Key Usage, validity, and key algorithm for its consumer.
Record the old certificate thumbprint and every service that references it.
Use an elevated session. Most server applications require Cert:\LocalMachine\My, not the interactive user's CurrentUser store.

Understand how Windows stores certificates

LocalMachine\My is the computer's Personal store. The certificate entry points to a private-key container protected by Windows ACLs. Importing as an administrator does not automatically give an arbitrary service account permission to use that key. Manage Private Keys in the Certificates MMC snap-in is therefore an operational part of replacement for services that do not run as Local System.

Step-by-step certificate replacement

Inspect the PFX without exposing its password in shell history:

$pfxPath = "C:\secure\replacement.pfx"
$pfxPassword = Read-Host "PFX password" -AsSecureString
Get-PfxData -FilePath $pfxPath -Password $pfxPassword |
  Format-List EndEntityCertificates,OtherCertificates

Import it into the Local Computer Personal store:

$imported = Import-PfxCertificate `
  -FilePath $pfxPath `
  -CertStoreLocation Cert:\LocalMachine\My `
  -Password $pfxPassword
$thumbprint = $imported.Thumbprint

Add -Exportable only when later re-export is an explicit requirement; it weakens a useful protection on the private key.

Confirm the private key and chain:

Get-Item "Cert:\LocalMachine\My\$thumbprint" |
  Format-List Subject,DnsNameList,NotAfter,EnhancedKeyUsageList,HasPrivateKey,Thumbprint
certutil -verify -urlfetch "Cert:\LocalMachine\My\$thumbprint"

If the consuming Windows service uses a dedicated identity, open certlm.msc, select Personal > Certificates, right-click the new certificate, then choose All Tasks > Manage Private Keys. Grant that identity Read, not Full Control.
Update the consumer's certificate setting or binding. Use the dedicated guide for IIS, AD FS, SQL Server, or the other product. Restart or reload only that product when its procedure requires it.

Product-specific considerations

The same certificate may be installed on multiple cluster nodes, but the private key and certificate-store entry are local to each node. Import it on every node that can terminate TLS. A Group Policy certificate distribution mechanism generally distributes public certificates and trust anchors; do not assume it distributes a server's private key.

Verify the new certificate

Verify both layers. First inspect the local store as above. Then connect to the actual hostname and port, because a healthy store says nothing about the active binding:

$client = [Net.Sockets.TcpClient]::new("service.example.com",443)
$stream = [Net.Security.SslStream]::new($client.GetStream(),$false,({$true}))
$stream.AuthenticateAsClient("service.example.com")
[Security.Cryptography.X509Certificates.X509Certificate2]::new($stream.RemoteCertificate) |
  Format-List Subject,Issuer,Thumbprint,NotAfter
$stream.Dispose(); $client.Dispose()

Rollback

Point the consuming service back to the recorded old thumbprint, restore its private key permission if changed, and perform that product's activation step. Do not delete the new entry until rollback is confirmed.

Common problems

The PFX was imported into CurrentUser instead of LocalMachine.
HasPrivateKey is false because only a .cer file was imported.
The service identity cannot read the key container.
The chain is incomplete or its root is not trusted by clients.
The correct certificate is installed but the application still references the old thumbprint.

Automating certificate replacement with aethercert

aethercert can import the certificate and private key into the selected Windows store. For product presets it can also perform the supported binding or assignment step; a plain Certificate store target intentionally creates no application binding.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.