Bridge SSL
What is a certificate store? The Windows SSL certificate store
A certificate store is the place where an operating system or an application keeps certificates. On Windows it is part of the system: certificates are stored locally on the computer, in the registry, and grouped into named stores by the type of certificate they hold [1][6]. It is one of the terms in the SSL and TLS glossary.
The Windows SSL certificate store is therefore not a store of its own. A server's SSL certificate sits in the Personal store of the computer, next to its link to the private key, while the certificates that vouch for it sit in the stores of certification authorities [5][7].
- Kept in
- the registry, under HKEY_LOCAL_MACHINE for the computer and HKEY_CURRENT_USER for one account [1][3]
- Store locations
- Local Computer, Current User and a service account [4]
- Server SSL certificates
- the My and WebHosting stores of the local machine [7]
Stores inside the Windows certificate store
Programs and commands open a store by its name [3][8]. The stores a site owner meets:
| Store name | What it holds |
|---|---|
| My (Personal) | certificates for which the private key is available, such as a server's own certificate [5][6][7] |
| CA | issuing and intermediate CA certificates [5][6] |
| Root | self-signed certificates of trusted root CAs [5][6] |
| WebHosting | server SSL certificates, alongside My [7] |
| TrustedPublisher | certificates of directly trusted publishers [6] |
| Disallowed | revoked certificates [6] |
The stores in this list are logical. Windows keeps the certificates in physical stores, and a logical store points to them, so one certificate can serve users, the computer and services without a copy for each [5]. Which roots belong in the Root store, who decides that, and how to add a private root are covered on the root certificates page of the certificates section.
Local Computer, Current User and service accounts
Each store exists in more than one location, and the location decides who sees the certificate [2][4]:
Local Computer. Global to all users of the device; under HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates [2][3].
certlm.mscopens it [4].Current User. Local to one account; under HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates [2][3].
certmgr.mscopens it, and a user who is not an administrator can manage only this one [4].Service account. Local to a particular service on the device [4].
The locations are linked. All Current User stores except Personal inherit the contents of the Local Computer stores: a root certificate added to the computer's Root store shows up for every user, while a personal certificate stays with its account [2]. certutil works on the machine store and switches to the user store with -user [8].
Where the private key is
A certificate carries the public key, and the private key is stored apart from it. For a certificate in the Personal store, Windows keeps properties naming the provider that holds the matching private key, and an application uses them to get the key from that provider [5]. CNG keeps private keys in directories of their own, for example %APPDATA%\Microsoft\Crypto\Keys for a user and %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\Keys for shared keys [9].
The split shows in PowerShell. Move-Item moves a certificate between stores of one location, as in Microsoft's example from My to WebHosting, but does not move private keys, and Remove-Item deletes a certificate and leaves its key in place unless you add -DeleteKey [7]. Moving a certificate to another server together with its key is an export to a PFX file, described in the installation guides of this site.
Finding SSL certificates in the store
One PowerShell command from Microsoft's documentation lists the server SSL certificates of the computer. The stores appear there as the Cert: drive, on Windows only [7]:
Get-ChildItem Cert:\LocalMachine\My -SSLServerAuthentication-SSLServerAuthentication keeps only server SSL certificates; -DnsName filters by the names in the certificate and -ExpiringInDays 0 returns the ones that have expired [7]. These parameters came back in PowerShell 7.1 [7]. Without PowerShell, certutil -store My dumps the Personal store of the computer [8].
Certificate store, trust store, keystore and keychain
A trust store is narrower than a certificate store. OpenSSL defines it as a collection of certificates trusted for certain uses, and compares it to the trust stores of Mozilla Firefox and to Apple's and Microsoft's certificate stores [10]. The Windows certificate store contains a trust store, the Root store, and also your own certificates in the Personal store, with links to their private keys. Intermediate CA certificates have a store of their own, CA [5]. Other systems use other words: Java calls its container a keystore, a storage facility for keys and certificates [14], and on a Mac it is a keychain [11].
On other systems
| Platform | Where certificates are kept | Your own certificate and key |
|---|---|---|
| Windows | the certificate store, per location [1][2] | the Personal (My) store, with the key at a cryptographic provider [5][9] |
| macOS | keychains, such as the login and System keychains, managed in Keychain Access [11] | the same keychains hold keys and certificates; exported certificates and keys are protected with a password [11] |
| Linux with OpenSSL | a file, or a directory used as a trust store [10] | files named in the server's configuration, for example nginx ssl_certificate and ssl_certificate_key in PEM [12] |
| Java | keystore files; the system-wide cacerts keystore ships with root CA certificates [14] | a key entry: the private key with its certificate chain; the default keystore type is pkcs12 [14] |
Firefox can be told to trust certificates that a user or an administrator added to the operating system certificate store, with the ImportEnterpriseRoots enterprise policy [13]. An app can also narrow trust below what the store allows and accept only a known key or certificate for a server; that is certificate pinning. Which certificates were issued for your names is a separate question, answered by public certificate transparency logs.
The certificate store on Bridge CDN
Bridge SSL is the certificate layer of Bridge CDN: TLS certificates are issued and renewed automatically where your site is served. TLS is terminated at the edge, so there is no certificate file on your machine, and Bridge SSL has no certificate upload: there is nothing to install [15].
FAQ
Where does Windows keep SSL server certificates?
In the Personal store, named My, of the local machine; Microsoft's PowerShell example looks for server SSL certificates in the My and WebHosting stores there. [7]
What is the difference between a certificate store and a trust store?
Sources
Microsoft Learn, Certificate Stores (Windows drivers).
Microsoft Learn, Local machine and current user certificate stores.
Microsoft Learn, System Store Locations; CertOpenSystemStore.
Microsoft Learn, How to: View certificates with the MMC snap-in.
Oracle Database Administrator's Reference for Windows, About Microsoft Certificate Stores.
Microsoft Learn, .NET StoreName enumeration.
Microsoft Learn, about_Certificate_Provider (PowerShell).
Microsoft Learn, certutil:
-store,-user.Microsoft Learn, Key Storage and Retrieval (CNG).
OpenSSL, openssl-verification-options manual page, version 3.0: Trust Anchors,
-CAfile,-CApath.Apple, Keychain Access User Guide: Add certificates to a keychain; View the information stored in a keychain; Import and export keychain items.
nginx, ngx_http_ssl_module:
ssl_certificate,ssl_certificate_key.Mozilla, Firefox enterprise policies: Certificates, ImportEnterpriseRoots.
Oracle, keytool, Java SE 21: Keystore entries, cacerts certificates file.
Bridge SSL, home page.