Windows certificate store - list, import and export certificates

Certificates is the page the toolkit opens on. It lists the personal certificates in the Windows certificate store - the same ones certmgr.msc (current user) and certlm.msc (local computer) show under Personal - and does the jobs those consoles make awkward: renewing a certificate as a new CSR, exporting it in the format a server needs, and importing the certificate a CA issued so that it is joined to its private key.

This page is Windows-only. The command-line equivalent is actk store.

User and ComputerCopy Anchor Link

On the Computer tab a Read-only banner explains the limit: importing, deleting and exporting private keys in the computer store need administrator rights. Choose Restart as administrator in that banner. Windows asks once (UAC), the toolkit restarts elevated and opens directly on the computer store.

Find a certificateCopy Anchor Link

• Search matches name, issuer and thumbprint.
• Filters: All, With private key, ≤ 30 days (expiring within 30 days) and Expired.
• Columns: Status, Issued to, Issuer, Expires, Purpose, Key and Friendly name. Click a column header to sort; drag its edge to resize.
• Status always pairs a word with its colour: Valid, the number of days left when 30 or fewer, or Expired.
• Keyboard: ↑ ↓ select, Del deletes; right-click opens the actions for a certificate.

Selecting a certificate opens its details beside the list, grouped into identity, validity, subject alternative names, issuer, cryptography and fingerprints (SHA-256 fingerprint, thumbprint and key pin, each with a copy button). Weak keys, SHA-1/MD5 signatures and self-signed certificates are flagged.

Renew a certificate as a new CSRCopy Anchor Link

Select the certificate and choose Create CSR from selection (or right-click, New CSR from this certificate). Create CSR opens pre-filled with the certificate's type, subject, names and key type. This works for a renewal and for a rekey: the request always gets a new key - the old key is never reused.

Empty CSR starts a request from a blank form instead.

Import an issued certificateCopy Anchor Link

When the CA has issued the certificate for a CSR you created here, choose Import … under Files. Import walks through five steps: Certificate file, Check contents, Destination, Review and Result.

1. Certificate file. Choose the file the CA sent - .cer, .crt, .pem or .p7b - or paste the PEM. A .pfx with its key works too (enter its password).

2. Check contents. The toolkit shows the certificate, the chain in the file, and which private key belongs to it. It finds the key by itself, by comparing the SHA-256 of the public key with the requests made in Create CSR:

   • a key in the Windows key store is linked to the certificate on import - it does not move;
   • a key from this session that was never saved (still only in memory) is imported with it;
   • a saved .key file is read from where you saved it.

   If no matching key is found, you can choose the .key file yourself. Without a private key the certificate imports, but cannot be used for TLS or signing on this machine.

3. Destination. Personal - this user or Personal - this computer. When the key is in the Windows key store, the request already decided this: the certificate goes into the store whose key store holds its key. For a key from a file you choose whether Windows may export it again later (Allow exporting the private key later) and can set a friendly name - by default the common name.

4. Review and Import.

Intermediate certificates go to Intermediate Certification Authorities. A root certificate is never installed by an import - trusting a root is a decision for the administrator, through certlm.msc or group policy.

After the import, bind the certificate to the service (IIS site, RDP, LDAPS), or export it in the format a server needs.

Export a certificateCopy Anchor Link

Select the certificate and choose Export …. Pick a preset or tick the formats you need; one export writes them all into the folder you choose.

• A .key file is encrypted with the password by default (Encrypt the .key with the password). Untick it only for a server that cannot read an encrypted key.
• Compatible with Windows Server 2016 and older writes the PFX with 3DES instead of AES-256. Windows Server 2016 and earlier cannot import an AES-256 PFX.
• Existing files are never overwritten. If one already exists in the folder, nothing is written.

.pfx and .key need the private key. If Windows marked the key as not exportable, or it lives on a smart card or HSM, only the certificate formats are available - the key stays where it is. Exporting the key of a computer certificate needs administrator rights.

To convert certificate files that are not in the store, use Convert files.

Copy and deleteCopy Anchor Link

• Copy PEM copies the certificate (public part only) as PEM text. Copy thumbprint is in the right-click menu.
• Delete … removes the certificate and its private key from the store, after a confirmation. This cannot be undone - export it first if it may be needed again.