Certificate Manager Tool (Certmgr.exe)
The Certificate Manager tool manages certificates, certificate trust lists (CTLs), and certificate revocation lists (CRLs).
certmgr [/add | /del | /put] [options] [/s[/r registryLocation]] [sourceStorename] [/s[/r registryLocation]] [destinationStorename]
Parameters
| Argument | Description |
|---|---|
| sourceStorename | The input certificate store as the type StoreFile, or the type system store. |
| destinationStorename | The output certificate store or file. |
| Option | Description |
|---|---|
| /add | Adds certificates, CTLs, and CRLs to a certificate store. |
| /all | Adds all entries when used with /add. Deletes all entries when used with /del. Displays all entries when used without the /add or /delete options. The /all option cannot be used with /put. |
| /c | Adds certificates when used with /add. Deletes certificates when used with /del. Saves certificates when used with /put. Displays certificates when used without the /add, /delete, or /put options. |
| /CRL | Adds or deletes CRLs. Displays CRLs when used without the /add, /delete, or /put options. |
| /CTL | Adds or deletes CTLs. Displays CTLs when used without the /add, /delete, or /put options. |
| /delete | Deletes certificates, CTLs, and CRLs from a specified certificate store. |
| /e encodingType | Specifies the certificate encoding type. |
| /f dwFlags | Specifies the store open flag. This is the dwFlags parameter passed to CertOpenStore. The default value is CERT_SYSTEM_STORE_CURRENT_USER. This option is considered only if the /y option is used. |
| /h[elp] | Displays command syntax and options for the tool. |
| /n commonName String | Specifies the common name of the certificate to add, delete, or save. This option can only be used with certificates; it cannot be used with CTLs or CRLs. |
| /put | Saves an X.509 certificate, CTL, or CRL from a certificate store to a file. The file will be saved in X.509 format. The /7 option can be used with the /put option to save the file in PKCS #7 format. The /put option must be followed by either /c, /CTL, or /CRL. The /all option cannot be used with /put. |
| /r registry location | Identifies the registry location of the system store. This option is considered only if you specify the /s option. Registry location must be one of the following:
|
| /s | Indicates that the certificate store is a system store. If you do not specify this option, the store is a StoreFile. |
| /sha1 sha1Hash | Specifies the SHA1 hash of the certificate, CTL, or CRL to add, delete, or save. |
| /v | Specifies verbose mode; displays detailed information about certificates, CTLs, and CRLs. This option cannot be used with the /add, /delete, or /put options. |
| /y storeProviderType | Specifies the store provider type. |
| /7 | Saves the destination store as a PKCS#7 object. |
| /? | Displays command syntax and options for the tool. |
Certmgr.exe performs the following basic functions:
-
Displays certificates, CTLs, and CRLs to the console.
-
Adds certificates, CTLs, and CRLs to a certificate store.
-
Deletes certificates, CTLs, and CRLs from a certificate store.
-
Saves an X.509 certificate, CTL, or CRL from a certificate store to a file.
Certmgr.exe works with two types of certificate stores: StoreFile and system store. It is not necessary to specify the type of certificate store; Certmgr.exe can identify the store type and perform the appropriate operations.
Running Certmgr.exe without specifying any options launches a GUI that helps with the certificate management tasks that are also available from the command line. The GUI provides an import wizard, which copies certificates, CTLs, and CRLs from your disk to a certificate store.
For more information about certificates, see the About CryptoAPI section of the Microsoft Platform SDK documentation.
The following command displays a default system store called my with verbose output.
certmgr /v /s my
The following command adds all the certificates in a file called myFile.ext to a new file called newFile.ext.
certmgr /add /all /c myFile.ext newFile.ext
The following command moves a certificate with the common name myCert in the my system store to a file called newCert.cer.
certmgr /add /c /n myCert /s my newCert.cer
The following command deletes all CTLs in the my system store and saves the resulting store to a file called newStore.str.
certmgr /del /all /ctl /s my newStore.str
The following command puts a certificate in the my system storein the file newFile. You will be prompted to enter the certificate number from my to put in newFile.
certmgr /put /c /s my newFile
Has anyone attempted to run certmgr? Every time I run this command it launches the Certificate Manager GUI but does not import my certificate:
certmgr /add /all /c "ThawtePremiumServerCA.cer" /s /r localMachine Root
You should use certmgr.exe, otherwise certmgr.msc is launched
Certmgr.exe and Certmgr.msc
From the documentation for the .NET Framework 3.5 and the .NET Framework 4:
The Certificate Manager tool (Certmgr.exe) is a command-line utility, whereas Certificates (Certmgr.msc) is a Microsoft Management Console (MMC) snap-in. Because Certmgr.msc is usually found in the Windows System directory, entering certmgr at the command line may load the Certificates MMC snap-in even if you have opened the Visual Studio Command Prompt. This occurs because the path to the snap-in precedes the path to the Certificate Manager tool in the PATH environment variable. If you encounter this problem, you can execute Certmgr.exe commands by specifying the path to the executable.
--Ron Petrusha
Common Language Runtime User Education
Microsoft Corporation
- 9/23/2009
- rosgil
- 7/11/2011
- R Petrusha - MSFT
[tfl - 10 10 10] Hi - and thanks for your post.You should post questions like this to the MSDN Forums at http://forums.microsoft.com/msdn. You are much more likely get a quick response
using the forums than through the Community Content.
For specific help about:
.Net Development : http://social.msdn.microsoft.com/Forums/en-US/category/visualstudio
Open Specifications : http://social.msdn.microsoft.com/Forums/en-US/category/openspecifications
SharePoint 2010 : http://social.msdn.microsoft.com/Forums/en-US/category/sharepoint2010
SQL : http://social.msdn.microsoft.com/Forums/en-US/category/sqlserver
Visual Studio : http://social.msdn.microsoft.com/Forums/en-US/category/visualstudio
- 9/17/2010
- Szypura
- 10/10/2010
- Thomas Lee
- 12/16/2009
- RahulVohra
