How to Install a Certificate on Windows 10

To install a certificate on Windows 10, double-click the certificate file, select Install Certificate, choose Current User or Local Machine, and let Windows pick the store or choose one yourself, such as Trusted Root Certification Authorities for a root certificate from your employer or school. Select Finish, and confirm the security warning if one appears. A .pfx file also asks for the password it was exported with.

Applies to: Windows 10, version 22H2. The same steps work on Windows 11.

Only install certificates you trust. A root certificate lets whoever issued it vouch for any website, so a malicious one could be used to intercept your secure browsing. Install root certificates only from your IT department, school or a vendor you know, never because a website or pop-up asks you to.

Which type of certificate do you have?

• .cer, .crt or .der: a public certificate with no private key. Usually a root or intermediate certificate for a company network, Wi-Fi, VPN or internal websites.
• .pfx or .p12: a certificate with its private key, protected by a password. Used to prove your identity, for example for signing documents, email encryption or client authentication. If your certificate came as separate .pem or .key files, you can combine them into a .pfx with OpenSSL once you install OpenSSL on Windows 10. Once a signing certificate is in your Personal store, Word can use it to add a digital signature to a Word document.
• .p7b: a bundle of several certificates, often a full chain from a certificate authority.

Method 1: Install with the Certificate Import Wizard

1. Double-click the certificate file. For a .cer or .crt file, select Install Certificate. A .pfx file opens the wizard directly.
2. Choose Current User to install it just for your account, or Local Machine to install it for everyone on the PC. Local Machine needs administrator rights.
3. Select Next.
4. For a .pfx file, enter its password. Tick Mark this key as exportable only if you need to move it to another PC later.
5. Choose where to put it:
   • Automatically select the certificate store works for most personal and intermediate certificates.
   • For a root certificate, choose Place all certificates in the following store, select Browse and pick Trusted Root Certification Authorities.
6. Select Next and then Finish.
7. If Windows shows a security warning about installing a root certificate, check that the thumbprint matches what your IT department gave you, then select Yes.

You should see The import was successful.

Method 2: Import with Certificate Manager

This is useful when you want to choose the exact store and check what’s already installed.

1. Press Windows key + R, type certmgr.msc for your account or certlm.msc for the whole PC, and press Enter.
2. Expand the store you want, such as Trusted Root Certification Authorities or Personal, and select Certificates.
3. Right-click Certificates and choose All Tasks > Import.
4. Browse to the file, then follow the wizard as in Method 1.

Other ways in, and what each store holds, are covered in opening Certificate Manager in Windows 10.

Method 3: Install from the command line

Handy for scripts or several PCs. Open Command Prompt or PowerShell as administrator.

• Root certificate for the whole PC: certutil -addstore -f Root "C:\Certs\company-root.cer"
• Root certificate for your account only: certutil -user -addstore Root "C:\Certs\company-root.cer"
• In PowerShell: Import-Certificate -FilePath "C:\Certs\company-root.cer" -CertStoreLocation Cert:\LocalMachine\Root
• A .pfx file in PowerShell: Import-PfxCertificate -FilePath "C:\Certs\me.pfx" -CertStoreLocation Cert:\CurrentUser\My -Password (Read-Host -AsSecureString)

Check that it worked

1. Open certmgr.msc or certlm.msc.
2. Look in the store you chose for a certificate with the expected name and expiry date.
3. Restart your browser, VPN or email app so it picks up the new certificate.

Browsers and apps that use their own certificates

Edge and Chrome use the Windows certificate store. Firefox has its own: to make it trust Windows root certificates, enter about:config, search for security.enterprise_roots.enabled and set it to true, or import the certificate in Firefox under Settings > Privacy & Security > View Certificates. Java apps and some developer tools also keep separate certificate stores.

Remove a certificate

In Certificate Manager, find the certificate, right-click it and choose Delete. Remove certificates you no longer need, especially old root certificates.

Troubleshooting

“The password you entered is incorrect”

The .pfx password is the one set when the file was exported, not your Windows password. Ask whoever sent the file.

The website still says the certificate isn’t trusted

The root certificate may be in the Personal store instead of Trusted Root Certification Authorities, or an intermediate certificate is missing. Reinstall it into the right store, or ask for the full chain (.p7b).

Install Certificate is greyed out for Local Machine

You need administrator rights. Choose Current User or sign in as an administrator.

Windows 10 is out of support. Staying on it for now? Enrolling in Windows 10 Extended Security Updates keeps security fixes coming.

Matt Jacobs

Matt Jacobs has been working as an IT consultant for small businesses since receiving his Master’s degree in 2003. While he still does some consulting work, his primary focus now is on creating technology support content for SupportYourTech.com.

His work can be found on many websites and focuses on topics such as Microsoft Office, Apple devices, Android devices, Photoshop, and more.