how to find out the valid store names for certutil

Question

I'm trying to find a way to script installing a certificate.

Going "right-click->install certificate" works, and shows the certificate under 'subordinate certification authorities' in IE's certificate view

If found the certutil.exe command,

certutil.exe -addstore -enterprise <storename>

My question is how do you list/find out the valid storenames?

score 15 · Accepted Answer · answered Aug 13 '12 at 18:21

15

Found a site with the valid store names which are:

ca -> Specifies certificates in the Intermediate Certification Authorities store
my -> Specifies certificates issued to the current user
root -> Specifies certificates in the Trusted Root Certification Authorities store
spc -> Specifies software publisher certificates
user_created_store -> Specifies the name of a user-created certificate store

answered Aug 13 '12 at 18:21

cobaco

443
1
4
10

1

`certutil -addstore “Root” “c:\cacert.cer”` for ***Trusted Root Certification Authorities*** – Kiquenet Apr 21 '16 at 14:36
Question: command `certutil -addstore “CA” “c:\cacert.cer”` for ***Intermediate Certification Authorities*** in _LocalMachine_ ? – Kiquenet Apr 21 '16 at 14:37

score 15 · Answer 2 · answered Apr 03 '17 at 07:41

15

You can quickly get the list in Powershell:

PS> ls Cert:\LocalMachine

Name : TrustedPublisher
Name : ClientAuthIssuer
Name : Remote Desktop
Name : Root
Name : TrustedDevices
Name : WebHosting
Name : CA
Name : REQUEST
Name : AuthRoot
Name : TrustedPeople
Name : My
Name : SmartCardRoot
Name : Trust
Name : Disallowed

answered Apr 03 '17 at 07:41

majkinetor

371
4
9

2

Now *this* should be the accepted answer. Did not realize you could iterate over them like a file system. – Tyler Montney Aug 29 '19 at 17:13

Piotr Kierklo · Answer 3 · 2013-10-07T15:09:27.960

also:

AddressBook -> specifies "Other People" store
Trust -> specifies "Enterprise Trust" store
TrustedPublisher -> specifies "Trusted Publishers" store

by the way, "spc" is not working for me

I think the list is here: http://msdn.microsoft.com/en-us/library/system.security.cryptography.x509certificates.storename.aspx

or here http://msdn.microsoft.com/en-us/library/microsoft.web.services2.security.x509.x509certificatestore_members.aspx

"root" and "trust" are not valid in the user context (when using -user switch)

score 7 · Answer 4 · answered Nov 01 '21 at 00:34

7

This will enumerate all certificate stores:

certutil -enumstore

certutil -enumstore output

Check this answer for naming discrepancies: Certutil naming mismatch

answered Nov 01 '21 at 00:34

Synertry

83
1
3

how to find out the valid store names for certutil

4 Answers4