Can we know the exact location of the certificate (DigiCert, Verisign, etc..)?

Right now the only way to check the certificate is by using the MMC application in System32 or in our web browser (Internet Explorer, Firefox, etc..) Internet options.

up vote 20 down vote accepted

Windows' certificate store is (mostly) stored in the registry as outlined here. However, while IE, Chrome, Safari/iTunes, Outlook, etc. use Windows' certificate store, Firefox and Thunderbird use NSS' cross-platform certificate store. Opera also uses its own separate certificate store.

If you want to access Windows' certificate store, then you should use Microsoft's CryptoAPI. If you want to access the NSS certificate store, then you can use the NSS library.

There isn't any "folder" of certficates in Windows; it is stored in an internal database (Windows Registry) that you interface using the ways you listed in your original question. The easiest way to get to that database is just put certmgr.msc in your start/run box.


If you are really curious, you can find the actual registry entries under:

\SOFTWARE\Microsoft\SystemCertificates\

In HKEY_CURRENT_USER for user-specific certificates and HKEY_LOCAL_MACHINE for machine-specific certificates, But they will be un-readable binary blobs. It is just better to use the MMC snap-in I listed earlier.

The certificates are stored in the registry at

HKLM/Software/Microsoft/SystemCertificates

Personal certificates, or other certificates specific to the logged in user are at

HKCU/Software/Microsoft/SystemCertificates

They are stored as binary blobs, so they need to be decoded, and the MMC plugin is a good way to do this.

  • In my windows 7 x64 PC, the path is as follows:HKLM/Software/Microsoft/SystemCertificates and HKCU/Software/Microsoft/SystemCertificates. Note the missing System. – Naai Sekar Aug 18 '13 at 7:15
  • 1
    @ashwin Hi ashwin - I have correct the answer. Please note, if you see that a correction is needed, you are welcome and encouraged to edit the post yourself. – Paul Aug 18 '13 at 9:36
  • I am not a expert on this topic. I found my PC was different from the one mentioned and I was not sure if mine was exception or if it is the usual way. – Naai Sekar Aug 18 '13 at 10:02
  • @ashwin Aah, great, I see. Thanks for the heads up on the error. – Paul Aug 19 '13 at 0:24

Here is a location summary (registry keys and files):

User level (registry):

HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates: Contains settings certificates for the current user.

HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates: Like the previous location, but this corresponds to user certificates deployed a GPO (Group Policy).

HKEY_USERS\SID-User\Software\Microsoft\SystemCertificates: Corresponds to the configuration of certain user certificates. Each user has its branch in the registry with SID (Security Identifier).

Computer level (registry):

HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates: Contains settings certificates for all computer users.

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates: Like the previous location, but this corresponds to computer certificates deployed a GPO.

Service level (registry):

HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates: Contains settings certificates for all services on the computer.

Active Directory level (registry):

HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates: Certificates issued at Active Directory level.

And there are some folders and files corresponding to the Windows certificate store.

The folders are hidden and public and private keys are located in different folders.

User certificates (files):

%APPDATA%\Microsoft\SystemCertificates\My\Certificates
%USERPROFILE%\AppData\Roaming\Microsoft\Crypto\RSA\SID
%USERPROFILE%\AppData\Roaming\Microsoft\Credentials
%USERPROFILE%\AppData\Roaming\Microsoft\Protect\SID

Computer certificates (files):

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

Extracted from: http://www.sysadmit.com/2017/10/windows-donde-se-guardan-certificados.html

I looked again at the group policy preference I was using. There is an option "Run in logged-on user's security context (user policy option)" that I enabled and now the registry entry is persisting

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.