User certificates are “mapped” and are unique for each user, even on the same systems. User certificates are located within the current user’s profile and are only logically mapped within that user’s context. This is the common use case for certificate-based authentication processes such as wired IEEE 802.1x. If you intend for a certificate to be used by a single user, then a user certificate store inside the Windows certificate manager is ideal. For the rest of this article, a certificate in a user and computer context will be informally called user certificates and computer certificates. A certificate is placed in one of these two contexts depending on if the certificate should be used by a single user, multiple users, or the computer itself.

Windows stores certificates in two different areas – a user and computer context. Logical stores are much easier to work with than physical stores for most common use cases. Logical stores are dynamic references that reference one or more physical stores. Physical stores reference the actual file system or registry location where the registry key(s) and/or file(s) are stored.

You’ll sometimes see certificate stores referred to as physical or logical stores. This simpler manner lets you work with a single object while Windows takes care of how to represent that object on disk. When working with a certificate in a store, you are interfacing with the logical store not directly modifying the registry or file system. You will read about how to differentiate these stores and how to work with them below.Įach store is located in the Windows Registry and on the file system. Unfortunately, certificate stores are not the most intuitive concept with which to work. Certificate stores are “buckets” where Windows keeps all certificates that are currently installed and a certificate can be in more than one store. Within the Windows certificate manager, all certificates exist in logical storage locations referred to as certificate stores. If you’d like to learn more about how certificates work in general, check out this article’s companion X.509 Certificate Tutorial article. This article will cover mainly working with certificates in Windows. Using the Windows certificate manager as a tool, you can do it!Ĭertificates are notoriously complex and hard to understand but in this article, you’ll get a chance to discover certificates aren’t that scary in Windows!

Working with certificates in Windows is typically one of those extra hats a sysadmin has to take on. If you’re a Windows system administrator, you might have been forced to work with windows certificates.

Windows 10 certificate manager