27

I need to import a PEM certificate on a massive number of freshly installed Windows 7 Enterprise machines.

Normally, I would do it through MMC → Certificates (Local Computer) snap-in → Trusted Root Certificates → Import, but I need to speed things up. Therefore, I'd like to use only the command prompt.

With certmgr.exe (not certmgr.msc!), I would type:

certmgr.exe -add -c C:\certificate.pem -s -r localMachine root

The problem is that certmgr.exe does not exist in Windows 7. How then can I add a certificate from the command line?

50

You need to use certutil.exe instead:

certutil –addstore -enterprise –f "Root" <pathtocertificatefile>

will add the certificate to the Trusted Root Certification Authorities store.

If you want to add an Intermediate Certification Authority, replace Root with CA and to add to your Personal store, change it to My.

All the above adds the certificate to the Local Computer store. To add to the User store remove the -enterprise from the command line:

certutil –addstore –f "Root" <pathtocertificatefile>

The -f in the command simply forces an overwrite in the case where the certificate is already installed.

| improve this answer | |
  • 1
    One of the most useful answers I've seen for a long time, especially with the additional hints. Upvoted. – KeyszerS Jul 26 '16 at 6:23
  • Where to get certutil.exe ? The only links I found are for 32bit only – David162795 Jun 29 '17 at 11:44
  • On every Windows computer :-) It should be installed by default on every Windows installation. – garethTheRed Jun 29 '17 at 11:50
  • To add to the User store remove the -enterprise: Removing -enterprise appears to try add it to the machine store and -user was required to choose the user store. Maybe things changed in Windows 10. Here's the relevant doc: Use -user to access a user store instead of a machine store.--docs.microsoft.com/en-us/windows-server/administration/… – antak Apr 9 '19 at 6:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.