Certificate Management in Windows

Certificate Management in Windows

Certificates are everywhere in enterprise IT. Here’s how to manage them in Windows.

Certificate Stores

# View certificate stores
Get-ChildItem Cert:

# Local Machine stores
Cert:\LocalMachine\My        # Personal
Cert:\LocalMachine\Root       # Trusted Root
Cert:\LocalMachine\CA         # Intermediate CA
Cert:\LocalMachine\TrustedPeople

# Current User stores
Cert:\CurrentUser\My
Cert:\CurrentUser\Root

View Certificates

# List certificates in store
Get-ChildItem -Path Cert:\LocalMachine\My

# Find expiring certificates
Get-ChildItem -Path Cert:\LocalMachine\My | 
    Where-Object { $_.NotAfter -lt (Get-Date).AddDays(30) } |
    Select-Object Subject, NotAfter, Thumbprint

Install Certificate

# From file
$Cert = Import-Certificate -FilePath "C:\certs\mycert.cer" -CertStoreLocation Cert:\LocalMachine\My

# From PFX (with private key)
$PfxPassword = Read-Host 'PFX password' -AsSecureString
$Cert = Import-PfxCertificate -FilePath 'C:\certs\mycert.pfx' -CertStoreLocation Cert:\LocalMachine\My -Password $PfxPassword

Request Certificate from CA

# Request and enrollment steps depend on the CA product and certificate
# template. Use the CA's documented certreq or enrollment workflow. The
# placeholder cmdlet names above common tutorials often invent are not built in.

Export Certificates

# Export without private key
Export-Certificate -Cert Cert:\LocalMachine\My\Thumbprint -FilePath "C:\certs\export.cer"

# Export with private key (PFX)
$Cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object Thumbprint -eq 'THUMBPRINT_TO_REVIEW'
if (@($Cert).Count -ne 1) { throw 'Select exactly one reviewed certificate thumbprint before exporting.' }
$PfxPassword = Read-Host 'New backup PFX password' -AsSecureString
Export-PfxCertificate -Cert $Cert -FilePath 'C:\certs\backup.pfx' -Password $PfxPassword

Remove Expired Certificates

# Find expired certificates for review; expiration alone does not prove a
# certificate is unused or safe to remove.
Get-ChildItem -Path Cert:\LocalMachine\My |
    Where-Object { $_.NotAfter -lt (Get-Date) } |
    Select-Object Subject, Issuer, NotAfter, Thumbprint, HasPrivateKey

# Remove specific certificate
$Target = Get-Item 'Cert:\LocalMachine\My\THUMBPRINT_TO_REVIEW' -ErrorAction Stop
$Target | Remove-Item -WhatIf

SSL Certificate Binding

# Bind certificate to IIS
New-WebBinding -Name "Default Web Site" -Protocol https -Port 443 -SslCertificateThumbprint "thumbprint"

# Or use netsh
netsh http add sslcert ipport=0.0.0.0:443 certhash=thumbprint appid="{guid}"

Check Certificate Chain

# Verify chain
$Cert = Get-ChildItem -Path Cert:\LocalMachine\My | Select-Object -First 1
[System.Security.Cryptography.X509Certificates.X509Chain]::Create().Chain.Build($Cert)

Wrap-Up

Certificates are essential. Automate expiration checks and always have a renewal process.

Questions? Drop them below!