Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When adding certificates, stls, ctls and crls to the system I can choose the certificate store.

I have found so far only references to the "my" and "root" stores.

Is there any other?

share|improve this question
    
What is "stls", "ctls" and "crls" (in this context)? –  Peter Mortensen Apr 2 at 18:18

2 Answers 2

up vote 17 down vote accepted
+25

There are three types of certificate stores in Windows.

  1. User Account store
  2. Service Account store
  3. Local Computer store

Each of the three stores contain a number of folders which certificates go into

  • Personal (can be known as My when using scripts to add certs)
  • Trusted Root Certification Authority (can be known as Root)
  • Enterprise Trust
  • Intermediate Certification Authority
  • Active Directory User Object
  • Trusted Publishers
  • Untrusted Certificates
  • Third Party Root Certification Authorities
  • Trusted People

These can be seen if you open up an mmc.exe with the Certificates snapin.

Depending on what the certificate is meant to be doing you have to work out where it would go.

Most of the time on the servers we support we use the Computer Account store (as its accessible by all users on a Computer) and put certificates in the Personal store. Some times you might need to add in the signing authority public key certs into the Root and Intermediate Root CAs.

share|improve this answer
    
Where the STL (Silent Trusted Root Authority) go? Which store and folder? –  Jader Dias Dec 16 '10 at 15:37
    
I guess "my" is an alias to the current user account store, and "root" is na alias to the machine store, right? –  Jader Dias Dec 16 '10 at 15:38
    
Not quite...each of the stores has a Personal folder (in some of the scripts I've messed with they've been referenced like this CU\My (Current User) or LM\My (Local Machine) ). –  daed Dec 16 '10 at 19:45
    
As for your Silent Trusted Root Authority, I've not heard of that term before.... –  daed Dec 16 '10 at 19:45
    
In Windows 7 they introduced another standard store named "Other People" (internally known as AddressBook) which contain certificates from people that send you Signed emails/documents... The problem is that this store must be manually added to systems running older versions of Windows (Windows Server 2008 R2, for instance) do that apps that rely on it can work properly. –  Monoman Mar 30 '12 at 11:45

Certificate storeNames are as follows (source) :

  • AddressBook: Certificate store for other people and resources.
  • AuthRoot: Certificate store for third-party certification authorities (CAs).
  • CertificationAuthority: Certificate store for intermediate certification authorities (CAs).
  • Disallowed: Certificate store for certificates that have been revoked so they aren't forgotten.
  • My: Certificate store for your personal certificates that you use and is where most custom certificates.
  • Root: Certificate store for certificate authorities (CA) that you trust.
  • TrustedPeople: Certificate store for other people and resources that you trust.
  • TrustedPublisher: Certificate store for application publishers that you trust.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.