Import certificates using command line on Windows

Question

I need to import a certificate file to Trusted Root Certification Authorities store, to get rid of an SSL warning when visiting my local website. The way I currently do it is lengthy: use Google Chrome → Settings → Advanced → Privacy and security → Manage certificates → Trusted Root Certification Authorities → Import...

It looks like some sort of Windows snap-in rather than a custom window of Chrome. This is dumb to do all these steps just to import a 1KiB certificate file. Can I do it on PowerShell, so that this action can be automated via script? Or at least how can I open the above window without Google Chrome?

Solution

If you are on a current version of Windows, you can use PowerShell cmdlets:

Import-Certificate -FilePath "C:\CA-PublicKey.Cer" -CertStoreLocation Cert:\LocalMachine\Root

otherwise use certutil:

certutil.exe -addstore root c:\capublickey.cer

Comments

[Livy]

Haven't test certutil.exe, but Import-Certificate works. Btw, what is the difference between cert:\CurrentUser\Root and Cert:\LocalMachine\Root? I am not familiar with Windows shell scripting.

[Peter Hahndorf]

@Livy - as the names suggest CurrentUser is the certificate store only for the currently logged-on user, LocalMachine is computer-wide, and those certificates can be used by all users.

[Livy]

So that's why I can no longer use the Certificates window above to remove it, as it requires administrative permission. I think I will add it to cert:\CurrentUser\Root next time.

[0xC0000022L]

@Livy because these are two different stores. The same utility can be used - in principle - to interact with the certificate store, but certmgr.msc is hardwired to the "current user" trust store. If you want any of the others, use mmc.exe and add the appropriate snap-in wired to an alternative trust store.

[João Pimentel Ferreira]

how can I use certutil.exe to add a certificate available in a URL?

[Peter Hahndorf]

@JoãoPimentelFerreira - You should ask a new question and explain what you mean. A URL doesn't contain a certificate.

[João Pimentel Ferreira]

@PeterHahndorf I meant if I have on my server a direct link to the public certificate file http://exemple.com/direct/path/to/capublickey.cer

[Geoffrey]

This works for Chrome, but not for Firefox.