CertUtil: Import a .cer certificate from the command line

Windows provides several ways to import certificates: the Certificates snap-in for MMC, Internet Explorer and the command-line tool certutil.exe.

Certutil.exe lets you manage digital certificates from the command line.

The graphical tools are enough in many cases, but some tasks need a command-line tool. I use certutil.exe when distributing software packages with Microsoft ConfigMgr 2007 (SCCM).

Import a certificate into the Current User store

This example imports a .CER certificate into the Personal folder under “Current User - My User account”:

1. Open Command Prompt (cmd.exe).
2. Go to the folder containing the .CER file.
3. Run the following command:

1

certutil -addstore -user -f "My" "VeriSign Class 3 Code Signing 2010 CA - valid 01-2014.cer"

The certificate has now been imported. In this example, I imported a missing VeriSign code-signing certificate.

Certutil.exe can also import certificates into the Computer account portion and control the certificate’s folder placement.

Reference

• MSDN: Adding certificates to the local certificates store and setting local policy using a command line