Caution
Certutil isn't recommended to be used in any production code and doesn't provide any guarantees of live site support or application compatibilities. It's a tool utilized by developers and IT administrators to view certificate content information on devices.
Certutil.exe is a command-line program installed as part of Certificate Services. You can use certutil.exe to display certification authority (CA) configuration information, configure Certificate Services, and back up and restore CA components. The program also verifies certificates, key pairs, and certificate chains.
If certutil is run on a certification authority without other parameters, it displays the current certification authority configuration. If certutil is run on a non-certification authority without other parameters, the command defaults to running the certutil -dump command. Not all versions of certutil provide all of the parameters and options that this document describes. You can see the choices that your version of certutil provides by running certutil -? or certutil <parameter> -?.
Tip
To see complete help for all certutil verbs and options, including ones that are hidden from the -? argument, run certutil -v -uSAGE. The uSAGE switch is case-sensitive.
Dumps the configuration information or files.
certutil [options] [-dump]
certutil [options] [-dump] File
Options:
[-f] [-user] [-Silent] [-split] [-p Password] [-t Timeout]
Dumps the PFX structure.
certutil [options] [-dumpPFX] File
Options:
[-f] [-Silent] [-split] [-p Password] [-csp Provider]
Parses and displays the contents of a file using Abstract Syntax Notation (ASN.1) syntax. File types include .CER, .DER and PKCS #7 formatted files.
certutil [options] -asn File [type]
[type]: numeric CRYPT_STRING_* decoding typeDecodes a hexadecimal-encoded file.
certutil [options] -decodehex InFile OutFile [type]
[type]: numeric CRYPT_STRING_* decoding typeOptions:
[-f]
Encodes a file in hexadecimal.
certutil [options] -encodehex InFile OutFile [type]
[type]: numeric CRYPT_STRING_* encoding typeOptions:
[-f] [-nocr] [-nocrlf] [-UnicodeText]
Decodes a Base64-encoded file.
certutil [options] -decode InFile OutFile
Options:
[-f]
Encodes a file to Base64.
certutil [options] -encode InFile OutFile
Options:
[-f] [-unicodetext]
Denies a pending request.
certutil [options] -deny RequestId
Options:
[-config Machine\CAName]
Resubmits a pending request.
certutil [options] -resubmit RequestId
Options:
[-config Machine\CAName]
Sets attributes for a pending certificate request.
certutil [options] -setattributes RequestId AttributeString
Where:
Options:
[-config Machine\CAName]
CertificateTemplate:User\nEMail:User@Domain.com where the \n sequence is converted to a newline separator.Set an extension for a pending certificate request.
certutil [options] -setextension RequestId ExtensionName Flags {Long | Date | String | @InFile}
Where:
0 is recommended, while 1 sets the extension to critical, 2 disables the extension, and 3 does both.Options:
[-config Machine\CAName]
\@, the rest of the token is taken as the filename with binary data or an ASCII-text hex dump.Revokes a certificate.
certutil [options] -revoke SerialNumber [Reason]
Where:
Options:
[-config Machine\CAName]
Displays the disposition of the current certificate.
certutil [options] -isvalid SerialNumber | CertHash
Options:
[-config Machine\CAName]
Gets the default configuration string.
certutil [options] -getconfig
Options:
[-idispatch] [-config Machine\CAName]
Gets the default configuration string via ICertGetConfig.
certutil [options] -getconfig2
Options:
[-idispatch]
Gets configuration via ICertConfig.
certutil [options] -getconfig3
Options:
[-idispatch]
Attempts to contact the Active Directory Certificate Services Request interface.
certutil [options] -ping [MaxSecondsToWait | CAMachineList]
Where:
Options:
[-config Machine\CAName] [-Anonymous] [-Kerberos] [-ClientCertificate ClientCertId] [-UserName UserName] [-p Password]
Attempts to contact the Active Directory Certificate Services Admin interface.
certutil [options] -pingadmin
Options:
[-config Machine\CAName]
Displays information about the certification authority.
certutil [options] -CAInfo [InfoName [Index | ErrorCode]]
Where:
Options:
[-f] [-split] [-config Machine\CAName]
Displays CA Property Type information.
certutil [options] -CAInfo [InfoName [Index | ErrorCode]]
Options:
[-idispatch] [-v1] [-admin] [-config Machine\CAName]
Retrieves the certificate for the certification authority.
certutil [options] -ca.cert OutCACertFile [Index]
Where:
Options:
[-f] [-split] [-config Machine\CAName]
Retrieves the certificate chain for the certification authority.
certutil [options] -ca.chain OutCACertChainFile [Index]
Where:
Options:
[-f] [-split] [-config Machine\CAName]
Gets a certificate revocation list (CRL).
certutil [options] -GetCRL OutFile [Index] [delta]
Where:
Options:
[-f] [-split] [-config Machine\CAName]
Publishes new certificate revocation lists (CRLs) or delta CRLs.
certutil [options] -CRL [dd:hh | republish] [delta]
Where:
Options:
[-split] [-config Machine\CAName]
Shuts down the Active Directory Certificate Services.
certutil [options] -shutdown
Options:
[-config Machine\CAName]
Installs a certification authority certificate.
certutil [options] -installCert [CACertFile]
Options:
[-f] [-silent] [-config Machine\CAName]
Renews a certification authority certificate.
certutil [options] -renewCert [ReuseKeys] [Machine\ParentCAName]
Options:
[-f] [-silent] [-config Machine\CAName]
-f to ignore an outstanding renewal request, and to generate a new request.Dumps the schema for the certificate.
certutil [options] -schema [Ext | Attrib | CRL]
Where:
Options:
[-split] [-config Machine\CAName]
Dumps the certificate view.
certutil [options] -view [Queue | Log | LogFail | Revoked | Ext | Attrib | CRL] [csv]
Where:
Options:
[-silent] [-split] [-config Machine\CAName] [-restrict RestrictionList] [-out ColumnList]
-out StatusCode-restrict RequestId==$-restrict requestID>=37,requestID<40 -out requestID,disposition-restrict crlminbase=0 -out crlrowID,crlnumber crl-v -restrict crlminbase=0,crlnumber=3 -out crlrawcrl crlCRLDate[+|-dd:hh] for date restrictions.now+dd:hh for a date relative to the current time.Dumps the raw database.
certutil [options] -db
Options:
[-config Machine\CAName] [-restrict RestrictionList] [-out ColumnList]
Deletes a row from the server database.
certutil [options] -deleterow RowId | Date [Request | Cert | Ext | Attrib | CRL]
Where:
Options:
[-f] [-config Machine\CAName]
1/22/2001 request1/22/2001 cert371/22/2001 crlNote
Date expects the format mm/dd/yyyy rather than dd/mm/yyyy, for example 1/22/2001 rather than 22/1/2001 for January 22, 2001. If your server isn't configured with US regional settings, using the Date argument might produce unexpected results.
Backs up the Active Directory Certificate Services.
certutil [options] -backup BackupDirectory [Incremental] [KeepLog]
Where:
Options:
[-f] [-config Machine\CAName] [-p Password] [-ProtectTo SAMNameAndSIDList]
Backs up the Active Directory Certificate Services database.
certutil [options] -backupdb BackupDirectory [Incremental] [KeepLog]
Where:
Options:
[-f] [-config Machine\CAName]
Backs up the Active Directory Certificate Services certificate and private key.
certutil [options] -backupkey BackupDirectory
Where:
Options:
[-f] [-config Machine\CAName] [-p password] [-ProtectTo SAMNameAndSIDList] [-t Timeout]
Restores the Active Directory Certificate Services.
certutil [options] -restore BackupDirectory
Where:
Options:
[-f] [-config Machine\CAName] [-p password]
Restores the Active Directory Certificate Services database.
certutil [options] -restoredb BackupDirectory
Where:
Options:
[-f] [-config Machine\CAName]
Restores the Active Directory Certificate Services certificate and private key.
certutil [options] -restorekey BackupDirectory | PFXFile
Where:
Options:
[-f] [-config Machine\CAName] [-p password]
Exports the certificates and private keys. For more information, see the -store parameter in this article.
certutil [options] -exportPFX [CertificateStoreName] CertId PFXFile [Modifiers]
Where:
TripleDES-Sha1 or Aes256-Sha256.Imports the certificates and private keys. For more information, see the -store parameter in this article.
certutil [options] -importPFX [CertificateStoreName] PFXFile [Modifiers]
Where:
Options:
[-f] [-Enterprise] [-user] [-GroupPolicy] [-Silent] [-p Password] [-csp Provider]
Displays a dynamic file list.
certutil [options] -dynamicfilelist
Options:
[-config Machine\CAName]
Displays database locations.
certutil [options] -databaselocations
Options:
[-config Machine\CAName]
Generates and displays a cryptographic hash over a file.
certutil [options] -hashfile InFile [HashAlgorithm]
Dumps the certificate store.
certutil [options] -store [CertificateStoreName [CertId [OutputFile]]]
Where:
CertificateStoreName is the certificate store name. For example:
My, CA (default), Root,ldap:///CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?cACertificate?one?objectClass=certificationAuthority (View Root Certificates)ldap:///CN=CAName,CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?cACertificate?base?objectClass=certificationAuthority (Modify Root Certificates)ldap:///CN=CAName,CN=MachineName,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint (View CRLs)ldap:///CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?cACertificate?base?objectClass=certificationAuthority (Enterprise CA Certificates)ldap: (AD computer object certificates)-user ldap: (AD user object certificates)CertId is the certificate or CRL match token. This ID can be a:
Many of these identifiers might result in multiple matches.
Options:
[-f] [-Enterprise] [-user] [-GroupPolicy] [-Silent] [-split] [-dc DCName]
-user option accesses a user store instead of a machine store.-enterprise option accesses a machine enterprise store.-service option accesses a machine service store.-grouppolicy option accesses a machine group policy store.For example:
-enterprise NTAuth-enterprise Root 37-user My 26e0aaaf000000000004CA .11Note
Performance issues are observed when using the -store parameter given these two aspects:
If you're concerned about performance issues, PowerShell commands are recommended where it will only match the specified certificate type.
-enumstoreEnumerates the certificate stores.
certutil [options] -enumstore [\\MachineName]
Where:
Options:
[-enterprise] [-user] [-grouppolicy]
Adds a certificate to the store. For more information, see the -store parameter in this article.
certutil [options] -addstore CertificateStoreName InFile
Where:
Options:
[-f] [-Enterprise] [-user] [-GroupPolicy] [-dc DCName]
Deletes a certificate from the store. For more information, see the -store parameter in this article.
certutil [options] -delstore CertificateStoreName certID
Where:
Options:
[-f] [-Enterprise] [-user] [-GroupPolicy] [-Silent] [-dc DCName]
Verifies a certificate in the store. For more information, see the -store parameter in this article.
certutil [options] -verifystore CertificateStoreName [CertId]
Where:
Options:
[-Enterprise] [-user] [-GroupPolicy] [-Silent] [-split] [-dc DCName] [-t Timeout]
Repairs a key association or update certificate properties or the key security descriptor. For more information, see the -store parameter in this article.
certutil [options] -repairstore CertificateStoreName CertIdList [PropertyInfFile | SDDLSecurityDescriptor]
Where:
CertificateStoreName is the certificate store name.
CertIdList is the comma-separated list of certificate or CRL match tokens. For more information, see the -store CertId description in this article.
PropertyInfFile is the INF file containing external properties, including:
[Properties]
19 = Empty ; Add archived property, OR:
19 = ; Remove archived property
11 = {text}Friendly Name ; Add friendly name property
127 = {hex} ; Add custom hexadecimal property
_continue_ = 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
_continue_ = 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
2 = {text} ; Add Key Provider Information property
_continue_ = Container=Container Name&
_continue_ = Provider=Microsoft Strong Cryptographic Provider&
_continue_ = ProviderType=1&
_continue_ = Flags=0&
_continue_ = KeySpec=2
9 = {text} ; Add Enhanced Key Usage property
_continue_ = 1.3.6.1.5.5.7.3.2,
_continue_ = 1.3.6.1.5.5.7.3.1,
Options:
[-f] [-Enterprise] [-user] [-GroupPolicy] [-Silent] [-split] [-csp Provider]
Dumps the certificates store. For more information, see the -store parameter in this article.
certutil [options] -viewstore [CertificateStoreName [CertId [OutputFile]]]
Where:
CertificateStoreName is the certificate store name. For example:
My, CA (default), Root,ldap:///CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?cACertificate?one?objectClass=certificationAuthority (View Root Certificates)ldap:///CN=CAName,CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?cACertificate?base?objectClass=certificationAuthority (Modify Root Certificates)ldap:///CN=CAName,CN=MachineName,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint (View CRLs)ldap:///CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?cACertificate?base?objectClass=certificationAuthority (Enterprise CA Certificates)ldap: (AD computer object certificates)-user ldap: (AD user object certificates)CertId is the certificate or CRL match token. This can be a:
Many of these may result in multiple matches.
Options:
[-f] [-Enterprise] [-user] [-GroupPolicy] [-dc DCName]
-user option accesses a user store instead of a machine store.-enterprise option accesses a machine enterprise store.-service option accesses a machine service store.-grouppolicy option accesses a machine group policy store.For example:
-enterprise NTAuth-enterprise Root 37-user My 26e0aaaf000000000004CA .11Deletes a certificate from the store.
certutil [options] -viewdelstore [CertificateStoreName [CertId [OutputFile]]]
Where:
CertificateStoreName is the certificate store name. For example:
My, CA (default), Root,ldap:///CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?cACertificate?one?objectClass=certificationAuthority (View Root Certificates)ldap:///CN=CAName,CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?cACertificate?base?objectClass=certificationAuthority (Modify Root Certificates)ldap:///CN=CAName,CN=MachineName,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?certificateRevocationList?base?objectClass=cRLDistributionPoint (View CRLs)ldap:///CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=cpandl,DC=com?cACertificate?base?objectClass=certificationAuthority (Enterprise CA Certificates)ldap: (AD computer object certificates)-user ldap: (AD user object certificates)CertId is the certificate or CRL match token. This can be a:
Many of these might result in multiple matches.
Options:
[-f] [-Enterprise] [-user] [-GroupPolicy] [-dc DCName]
-user option accesses a user store instead of a machine store.-enterprise option accesses a machine enterprise store.-service option accesses a machine service store.-grouppolicy option accesses a machine group policy store.For example:
-enterprise NTAuth-enterprise Root 37-user My 26e0aaaf000000000004CA .11Invokes the certutil interface.
certutil [options] -UI File [import]
Displays Trusted Platform Module Information.
certutil [options] -TPMInfo
Options:
[-f] [-Silent] [-split]
Specifies that the certificate request file should be attested.
certutil [options] -attest RequestFile
Options:
[-user] [-Silent] [-split]
Selects a certificate from a selection UI.
certutil [options] [ObjectId | ERA | KRA [CommonName]]
Options:
[-Silent] [-split]
Displays directory service (DS) distinguished names (DNs).
certutil [options] -ds [CommonName]
Options:
[-f] [-user] [-split] [-dc DCName]
Deletes DS DNs.
certutil [options] -dsDel [CommonName]
Options:
[-user] [-split] [-dc DCName]
Publishes a certificate or certificate revocation list (CRL) to Active Directory.
certutil [options] -dspublish CertFile [NTAuthCA | RootCA | SubCA | CrossCA | KRA | User | Machine]
certutil [options] -dspublish CRLfile [DSCDPContainer [DSCDPCN]]
Where:
Options:
[-f] [-user] [-dc DCName]
-f to create a new DS object.Displays DS certificates.
certutil [options] -dsCert [FullDSDN] | [CertId [OutFile]]
Options:
[-Enterprise] [-user] [-config Machine\CAName] [-dc DCName]
Displays DS CRLs.
certutil [options] -dsCRL [FullDSDN] | [CRLIndex [OutFile]]
Options:
[-idispatch] [-Enterprise] [-user] [-config Machine\CAName] [-dc DCName]
Displays DS delta CRLs.
certutil [options] -dsDeltaCRL [FullDSDN] | [CRLIndex [OutFile]]
Options:
[-Enterprise] [-user] [-config Machine\CAName] [-dc DCName]
Displays DS template attributes.
certutil [options] -dsTemplate [Template]
Options:
[Silent] [-dc DCName]
Adds DS templates.
certutil [options] -dsAddTemplate TemplateInfFile
Options:
[-dc DCName]
Displays Active Directory templates.
certutil [options] -ADTemplate [Template]
Options:
[-f] [-user] [-ut] [-mt] [-dc DCName]
Displays the certificate enrollment policy templates.
Options:
certutil [options] -Template [Template]
Options:
[-f] [-user] [-Silent] [-PolicyServer URLOrId] [-Anonymous] [-Kerberos] [-ClientCertificate ClientCertId] [-UserName UserName] [-p Password]
Displays the certification authorities (CAs) for a certificate template.
certutil [options] -TemplateCAs Template
Options:
[-f] [-user] [-dc DCName]
Displays templates for the Certificate Authority.
certutil [options] -CATemplates [Template]
Options:
[-f] [-user] [-ut] [-mt] [-config Machine\CAName] [-dc DCName]
Sets the certificate templates that the Certificate Authority can issue.
certutil [options] -SetCATemplates [+ | -] TemplateList
Where:
+ sign adds certificate templates to the CA's available template list.- sign removes certificate templates from the CA's available template list.Manages site names, including setting, verifying, and deleting Certificate Authority site names.
certutil [options] -SetCASites [set] [SiteName]
certutil [options] -SetCASites verify [SiteName]
certutil [options] -SetCASites delete
Where:
Options:
[-f] [-config Machine\CAName] [-dc DCName]
-config option targets a single Certificate Authority (default is all CAs).-f option can be used to override validation errors for the specified SiteName or to delete all CA site names.Displays, adds, or deletes enrollment server URLs associated with a CA.
certutil [options] -enrollmentServerURL [URL AuthenticationType [Priority] [Modifiers]]
certutil [options] -enrollmentserverURL URL delete
Where:
1 if not specified when adding a URL.Options:
[-config Machine\CAName] [-dc DCName]
Displays the Active Directory Certificate Authorities.
certutil [options] -ADCA [CAName]
Options:
[-f] [-split] [-dc DCName]
Displays the enrollment policy Certificate Authorities.
certutil [options] -CA [CAName | TemplateName]
Options:
[-f] [-user] [-Silent] [-split] [-PolicyServer URLOrId] [-Anonymous] [-Kerberos] [-ClientCertificate ClientCertId] [-UserName UserName] [-p Password]
Displays the enrollment policy.
certutil [options] -Policy
Options:
[-f] [-user] [-Silent] [-split] [-PolicyServer URLOrId] [-Anonymous] [-Kerberos] [-ClientCertificate ClientCertId] [-UserName UserName] [-p Password]
Displays or deletes enrollment policy cache entries.
certutil [options] -PolicyCache [delete]
Where:
Options:
[-f] [-user] [-policyserver URLorID]
Displays, adds, or deletes Credential Store entries.
certutil [options] -CredStore [URL]
certutil [options] -CredStore URL add
certutil [options] -CredStore URL delete
Where:
* to match all entries or https://machine* to match a URL prefix.Options:
[-f] [-user] [-Silent] [-Anonymous] [-Kerberos] [-ClientCertificate ClientCertId] [-UserName UserName] [-p Password]
Installs the default certificate templates.
certutil [options] -InstallDefaultTemplates
Options:
[-dc DCName]
Verifies certificate or CRL URLs.
certutil [options] -URL InFile | URL
Options:
[-f] [-split]
Displays or deletes URL cache entries.
certutil [options] -URLcache [URL | CRL | * [delete]]
Where:
Options:
[-f] [-split]
Pulses an autoenrollment event or NGC task.
certutil [options] -pulse [TaskName [SRKThumbprint]]
Where:
Options:
[-user]
Displays information about the Active Directory machine object.
certutil [options] -MachineInfo DomainName\MachineName$
Displays information about the domain controller. The default displays DC certificates without verification.
certutil [options] -DCInfo [Domain] [Verify | DeleteBad | DeleteAll]
Modifiers:
Options:
[-f] [-user] [-urlfetch] [-dc DCName] [-t Timeout]
Tip
The ability to specify an Active Directory Domain Services (AD DS) domain [Domain] and to specify a domain controller (-dc) was added in Windows Server 2012. To successfully run the command, you must use an account that is a member of Domain Admins or Enterprise Admins. The behavior modifications of this command are as follows:
For example, assume there's a domain named CPANDL with a domain controller named CPANDL-DC1. You can run the following command to a retrieve a list of domain controllers and their certificates from CPANDL-DC1: certutil -dc cpandl-dc1 -DCInfo cpandl.
Displays information about an enterprise Certificate Authority.
certutil [options] -EntInfo DomainName\MachineName$
Options:
[-f] [-user]
Displays information about the Certificate Authority.
certutil [options] -TCAInfo [DomainDN | -]
Options:
[-f] [-Enterprise] [-user] [-urlfetch] [-dc DCName] [-t Timeout]
Displays information about the smart card.
certutil [options] -scinfo [ReaderName [CRYPT_DELETEKEYSET]]
Where:
Options:
[-Silent] [-split] [-urlfetch] [-t Timeout]
Manages smart card root certificates.
certutil [options] -SCRoots update [+][InputRootFile] [ReaderName]
certutil [options] -SCRoots save @OutputRootFile [ReaderName]
certutil [options] -SCRoots view [InputRootFile | ReaderName]
certutil [options] -SCRoots delete [ReaderName]
Options:
[-f] [-split] [-p Password]
Lists the keys stored in a key container.
certutil [options] -key [KeyContainerName | -]
Where:
-user.- sign refers to using the default key container.Options:
[-user] [-Silent] [-split] [-csp Provider] [-Location AlternateStorageLocation]
Deletes the named key container.
certutil [options] -delkey KeyContainerName
Options:
[-user] [-Silent] [-split] [-csp Provider] [-Location AlternateStorageLocation]
Deletes the Windows Hello container, removing all associated credentials that are stored on the device, including any WebAuthn and FIDO credentials.
Users need to sign out after using this option for it to complete.
certutil [options] -DeleteHelloContainer
Verifies a public or private key set.
certutil [options] -verifykeys [KeyContainerName CACertFile]
Where:
-user.Options:
[-f] [-user] [-Silent] [-config Machine\CAName]
Verifies a certificate, certificate revocation list (CRL), or certificate chain.
certutil [options] -verify CertFile [ApplicationPolicyList | - [IssuancePolicyList]] [Modifiers]
certutil [options] -verify CertFile [CACertFile [CrossedCACertFile]]
certutil [options] -verify CRLFile CACertFile [IssuedCertFile]
certutil [options] -verify CRLFile CACertFile [DeltaCRLFile]
Where:
Options:
[-f] [-Enterprise] [-user] [-Silent] [-split] [-urlfetch] [-t Timeout] [-sslpolicy ServerName]
Verifies the AuthRoot or Disallowed Certificates CTL.
certutil [options] -verifyCTL CTLobject [CertDir] [CertFile]
Where:
CTLObject identifies the CTL to verify, including:
-f to download from Windows Update instead.-f to download from Windows Update instead.
-f to download from Windows Update instead.-f and an untrusted CertFile to force the registry cached AuthRoot and Disallowed Certificate CTLs to update.-f and an untrusted CertFile to force the registry cached AuthRoot and Disallowed Certificate CTLs to update.
-f has the same behavior as with PinRulesWU.CertDir specifies the folder containing certificates matching the CTL entries. Defaults to the same folder or website as the CTLobject. Using an http folder path requires a path separator at the end. If you don't specify AuthRoot or Disallowed, multiple locations are searched for matching certificates, including local certificate stores, crypt32.dll resources and the local URL cache. Use -f to download from Windows Update, as needed.
CertFile specifies the certificate(s) to verify. Certificates are matched against CTL entries, displaying the results. This option suppresses most of the default output.
Options:
[-f] [-user] [-split]
Syncs certificates with Windows Update.
certutil [options] -syncWithWU DestinationDir
Where:
The following files are downloaded by using the automatic update mechanism:
For example, certutil -syncWithWU \\server1\PKI\CTLs.
If you use a nonexistent local path or folder as the destination folder, you see the error: The system can't find the file specified. 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND)
If you use a nonexistent or unavailable network location as the destination folder, you see the error: The network name can't be found. 0x80070043 (WIN32: 67 ERROR_BAD_NET_NAME)
If your server can't connect over TCP port 80 to Microsoft Automatic Update servers, you receive the following error: A connection with the server couldn't be established 0x80072efd (INet: 12029 ERROR_INTERNET_CANNOT_CONNECT)
If your server is unable to reach the Microsoft Automatic Update servers with the DNS name ctldl.windowsupdate.com, you receive the following error: The server name or address couldn't be resolved 0x80072ee7 (INet: 12007 ERROR_INTERNET_NAME_NOT_RESOLVED).
If you don't use the -f switch, and any of the CTL files already exist in the directory, you receive a file exists error: certutil: -syncWithWU command FAILED: 0x800700b7 (WIN32/HTTP: 183 ERROR_ALREADY_EXISTS) Certutil: Can't create a file when that file already exists.
If there's a change in the trusted root certificates, you see: Warning! Encountered the following no longer trusted roots: <folder path>\<thumbprint>.crt. Use "-f" option to force the delete of the above ".crt" files. Was "authrootstl.cab" updated? If yes, consider deferring the delete until all clients have been updated.
Options:
[-f] [-Unicode] [-gmt] [-seconds] [-v] [-privatekey] [-pin PIN] [-sid WELL_KNOWN_SID_TYPE]
Generates a store file that is synced with Windows Update.
certutil [options] -generateSSTFromWU SSTFile
Where:
.sst file to be generated that contains the Third Party Roots downloaded from Windows Update.Options:
[-f] [-split]
Generates a Certificate Trust List (CTL) file that contains a list of pinning rules.
certutil [options] -generatePinRulesCTL XMLFile CTLFile [SSTFile [QueryFilesPrefix]]
Where:
.sst file to be created that contains all of the certificates used for pinning.Options:
[-f]
Downloads the OCSP responses and writes to the directory.
certutil [options] -downloadOcsp CertificateDir OcspDir [ThreadCount] [Modifiers]
Where:
Generates the HPKP header using certificates in a specified file or directory.
certutil [options] -generateHpkpHeader CertFileOrDir MaxAge [ReportUri] [Modifiers]
Where:
Flushes the specified caches in selected process, such as, lsass.exe.
certutil [options] -flushCache ProcessId CacheMask [Modifiers]
Where:
ProcessId is the numeric ID of a process to flush. Set to 0 to flush all processes where flush is enabled.
CacheMask is the bit mask of caches to be flushed either numeric or the following bits:
Modifiers are comma separated list of one or more of the following:
Adds an ECC Curve.
certutil [options] -addEccCurve [CurveClass:]CurveName CurveParameters [CurveOID] [CurveType]
Where:
CurveClass is the ECC Curve Class type:
CurveName is the ECC Curve name.
CurveParameters are one of the following:
CurveOID is the ECC Curve OID and is one of the following:
CurveType is the Schannel ECC NamedCurve point (numeric).
Options:
[-f]
Deletes the ECC Curve.
certutil [options] -deleteEccCurve CurveName | CurveOID
Where:
Options:
[-f]
Displays the ECC Curve.
certutil [options] -displayEccCurve [CurveName | CurveOID]
Where:
Options:
[-f]
Lists the cryptographic service providers (CSPs) installed on this machine for cryptographic operations.
certutil [options] -csplist [Algorithm]
Options:
[-user] [-Silent] [-csp Provider]
Tests the CSPs installed on this machine.
certutil [options] -csptest [Algorithm]
Options:
[-user] [-Silent] [-csp Provider]
Displays CNG cryptographic configuration on this machine.
certutil [options] -CNGConfig
Options:
[-Silent]
Re-signs a certificate revocation list (CRL) or certificate.
certutil [options] -sign InFileList | SerialNumber | CRL OutFileList [StartDate [+ | -dd:hh] + | -dd:hh] [+SerialNumberList | -SerialNumberList | -ObjectIdList | @ExtensionFile]
certutil [options] -sign InFileList | SerialNumber | CRL OutFileList [#HashAlgorithm] [+AlternateSignatureAlgorithm | -AlternateSignatureAlgorithm]
certutil [options] -sign InFileList OutFileList [Subject:CN=...] [Issuer:hex data]
Where:
InFileList is the comma-separated list of certificate or CRL files to modify and re-sign.
SerialNumber is the serial number of the certificate to create. The validity period and other options can't be present.
CRL creates an empty CRL. The validity period and other options can't be present.
OutFileList is the comma-separated list of modified certificate or CRL output files. The number of files must match infilelist.
StartDate+dd:hh is the new validity period for the certificate or CRL files, including:
now[+dd:hh] to start at the current time. Use now-dd:hh+dd:hh to start at a fixed offset from the current time and a fixed validity period. Use never to have no expiration date (for CRLs only).SerialNumberList is the comma-separated serial number list of the files to add or remove.
ObjectIdList is the comma-separated extension ObjectId list of the files to remove.
@ExtensionFile is the INF file that contains the extensions to update or remove. For example:
[Extensions]
2.5.29.31 = ; Remove CRL Distribution Points extension
2.5.29.15 = {hex} ; Update Key Usage extension
_continue_=03 02 01 86
HashAlgorithm is the name of the hash algorithm. This must only be the text preceded by the # sign.
AlternateSignatureAlgorithm is the alternate signature algorithm specifier.
Options:
[-nullsign] [-f] [-user] [-Silent] [-Cert CertId] [-csp Provider]
Creates or deletes web virtual roots and file shares.
certutil [options] -vroot [delete]
Creates or deletes web virtual roots for an OCSP web proxy.
certutil [options] -vocsproot [delete]
Adds an Enrollment Server application and application pool if necessary for the specified Certificate Authority. This command doesn't install binaries or packages.
certutil [options] -addEnrollmentServer Kerberos | UserName | ClientCertificate [AllowRenewalsOnly] [AllowKeyBasedRenewal]
Where:
addEnrollmentServer requires you to use an authentication method for the client connection to the Certificate Enrollment Server, including:
Modifiers:
Options:
[-config Machine\CAName]
Deletes an Enrollment Server application and application pool if necessary for the specified Certificate Authority. This command doesn't install binaries or packages.
certutil [options] -deleteEnrollmentServer Kerberos | UserName | ClientCertificate
Where:
Options:
[-config Machine\CAName]
Add a Policy Server application and application pool, if necessary. This command doesn't install binaries or packages.
certutil [options] -addPolicyServer Kerberos | UserName | ClientCertificate [KeyBasedRenewal]
Where:
Deletes a Policy Server application and application pool, if necessary. This command doesn't remove binaries or packages.
certutil [options] -deletePolicyServer Kerberos | UserName | ClientCertificate [KeyBasedRenewal]
Where:
Displays COM registry information.
certutil [options] -Class [ClassId | ProgId | DllName | *]
Options:
[-f]
Checks certificate for 0x7f length encodings.
certutil [options] -7f CertFile
Displays the object identifier or sets a display name.
certutil [options] -oid ObjectId [DisplayName | delete [LanguageId [type]]]
certutil [options] -oid GroupId
certutil [options] -oid AlgId | AlgorithmName [GroupId]
Where:
1 - Template (default)2 - Issuance Policy3 - Application Policy-f creates a DS object.Options:
[-f]
Displays the message text associated with an error code.
certutil [options] -error ErrorCode
Gets Simple Mail Transfer Protocol (SMTP) information.
certutil [options] -getsmtpinfo
Sets SMTP information.
certutil [options] -setsmtpinfo LogonName
Options:
[-config Machine\CAName] [-p Password]
Displays a registry value.
certutil [options] -getreg [{ca | restore | policy | exit | template | enroll | chain | PolicyServers}\[ProgId\]] [RegistryValueName]
Where:
-user for user templates).-user for user context).Name* to prefix match).+ or -, the bits specified in the new value are set or cleared in the existing registry value.Options:
[-f] [-Enterprise] [-user] [-GroupPolicy] [-config Machine\CAName]
+ or -, and the existing value is a REG_MULTI_SZ value, the string is added to or removed from the existing registry value. To force creation of a REG_MULTI_SZ value, add \n to the end of the string value.\@, the rest of the value is the name of the file containing the hexadecimal text representation of a binary value.[Date][+|-][dd:hh] which is an optional date plus or minus optional days and hours.now+dd:hh for a date relative to the current time.i64 as a suffix to create a REG_QWORD value.chain\chaincacheresyncfiletime @now to effectively flush cached CRLs.Sets a registry value.
certutil [options] -setreg [{ca | restore | policy | exit | template | enroll | chain | PolicyServers}\[ProgId\]] RegistryValueName Value
Where:
-user for user templates).-user for user context).Name* to prefix match).+ or -, the bits specified in the new value are set or cleared in the existing registry value.Options:
[-f] [-Enterprise] [-user] [-GroupPolicy] [-config Machine\CAName]
+ or -, and the existing value is a REG_MULTI_SZ value, the string is added to or removed from the existing registry value. To force creation of a REG_MULTI_SZ value, add \n to the end of the string value.\@, the rest of the value is the name of the file containing the hexadecimal text representation of a binary value.[Date][+|-][dd:hh] which is an optional date plus or minus optional days and hours.now+dd:hh for a date relative to the current time.i64 as a suffix to create a REG_QWORD value.chain\chaincacheresyncfiletime @now to effectively flush cached CRLs.Deletes a registry value.
certutil [options] -delreg [{ca | restore | policy | exit | template | enroll |chain | PolicyServers}\[ProgId\]][RegistryValueName]
Where:
-user for user templates).-user for user context).Name* to prefix match).+ or -, the bits specified in the new value are set or cleared in the existing registry value.Options:
[-f] [-Enterprise] [-user] [-GroupPolicy] [-config Machine\CAName]
+ or -, and the existing value is a REG_MULTI_SZ value, the string is added to or removed from the existing registry value. To force creation of a REG_MULTI_SZ value, add \n to the end of the string value.\@, the rest of the value is the name of the file containing the hexadecimal text representation of a binary value.[Date][+|-][dd:hh] which is an optional date plus or minus optional days and hours.now+dd:hh for a date relative to the current time.i64 as a suffix to create a REG_QWORD value.chain\chaincacheresyncfiletime @now to effectively flush cached CRLs.Imports user keys and certificates into the server database for key archival.
certutil [options] -importKMS UserKeyAndCertFile [CertId]
Where:
-store parameter in this article.-f imports certificates not issued by the Certificate Authority.Options:
[-f] [-Silent] [-split] [-config Machine\CAName] [-p Password] [-symkeyalg SymmetricKeyAlgorithm[,KeyLength]]
Imports a certificate file into the database.
certutil [options] -ImportCert Certfile [ExistingRow]
Where:
-f imports certificates not issued by the Certificate Authority.Options:
[-f] [-config Machine\CAName]
The Certificate Authority may also need to be configured to support foreign certificates by running certutil -setreg ca\KRAFlags +KRAF_ENABLEFOREIGN.
Retrieves an archived private key recovery blob, generates a recovery script, or recovers archived keys.
certutil [options] -GetKey SearchToken [RecoveryBlobOutFile]
certutil [options] -GetKey SearchToken script OutputScriptFile
certutil [options] -GetKey SearchToken retrieve | recover OutputFileBaseName
Where:
.rec extension for each key recovery blob. Each file contains a certificate chain and an associated private key, still encrypted to one or more Key Recovery Agent certificates..p12 extension. Each file contains the recovered certificate chains and associated private keys, stored as a PFX file.Options:
[-f] [-UnicodeText] [-Silent] [-config Machine\CAName] [-p Password] [-ProtectTo SAMNameAndSIDList] [-csp Provider]
.rec extensions are appended for each key recovery blob. Each file contains a certificate chain and an associated private key, still encrypted to one or more Key Recovery Agent certificates..p12 extension is appended. Contains the recovered certificate chains and associated private keys, stored as a PFX file.Recovers an archived private key.
certutil [options] -RecoverKey RecoveryBlobInFile [PFXOutFile [RecipientIndex]]
Options:
[-f] [-user] [-Silent] [-split] [-p Password] [-ProtectTo SAMNameAndSIDList] [-csp Provider] [-t Timeout]
Merges PFX files.
certutil [options] -MergePFX PFXInFileList PFXOutFile [Modifiers]
Where:
Options:
[-f] [-user] [-split] [-p password] [-ProtectTo SAMNameAndSIDList] [-csp Provider]
*, the user is prompted for the output file password.Adds a certificate chain.
certutil [options] -add-chain LogId certificate OutFile
Options:
[-f]
Adds a pre-certificate chain.
certutil [options] -add-pre-chain LogId pre-certificate OutFile
Options:
[-f]
Gets a signed tree head.
certutil [options] -get-sth [LogId]
Options:
[-f]
Gets signed tree head changes.
certutil [options] -get-sth-consistency LogId TreeSize1 TreeSize2
Options:
[-f]
Gets proof of a hash from a timestamp server.
certutil [options] -get-proof-by-hash LogId Hash [TreeSize]
Options:
[-f]
Retrieves entries from an event log.
certutil [options] -get-entries LogId FirstIndex LastIndex
Options:
[-f]
Retrieves the root certificates from the certificate store.
certutil [options] -get-roots LogId
Options:
[-f]
Retrieves an event log entry and its cryptographic proof.
certutil [options] -get-entry-and-proof LogId Index [TreeSize]
Options:
[-f]
Verifies a certificate against the Certificate Transparency log.
certutil [options] -VerifyCT Certificate SCT [precert]
Options:
[-f]
Displays the list of parameters.
certutil -?
certutil <name_of_parameter> -?
certutil -? -v
Where:
This section defines all of the options you're able to specify, based on the command. Each parameter includes information about which options are valid for use.
Option Description -admin Use ICertAdmin2 for CA properties. -anonymous Use anonymous SSL credentials. -cert CertId Signing certificate. -clientcertificate clientCertId Use X.509 Certificate SSL credentials. For selection UI, use-clientcertificate. -config Machine\CAName Certificate Authority and computer name string. -csp provider Provider:
(-loc) AlternateStorageLocation. -mt Display machine templates. -nocr Encode text without CR characters. -nocrlf Encode text without CR-LF characters. -nullsign Use the hash of the data as a signature. -oldpfx Use old PFX encryption. -out columnlist Comma-separated column list. -p password Password -pin PIN Smart card PIN. -policyserver URLorID Policy Server URL or ID. For selection U/I, use -policyserver. For all Policy Servers, use -policyserver * -privatekey Display password and private key data. -protect Protect keys with password. -protectto SAMnameandSIDlist Comma-separated SAM name/SID list. -restrict restrictionlist Comma-separated Restriction List. Each restriction consists of a column name, a relational operator, and a constant integer, string, or date. One column name may be preceded by a plus or minus sign to indicate the sort order. For example: requestID = 47, +requestername >= a, requestername, or -requestername > DOMAIN, Disposition = 21. -reverse Reverse Log and Queue columns. -seconds Display times using seconds and milliseconds. -service Use service certificate store. -sid Numeric SID:
silent flag to acquire crypt context. -split Split embedded ASN.1 elements, and save to files. -sslpolicy servername SSL Policy matching ServerName. -symkeyalg symmetrickeyalgorithm[,keylength] Name of the Symmetric Key Algorithm with optional key length. For example: AES,128 or 3DES. -syncWithWU DestinationDir Sync with Windows Update. -t timeout URL fetch timeout in milliseconds. -Unicode Write redirected output in Unicode. -UnicodeText Write output file in Unicode. -urlfetch Retrieve and verify AIA Certs and CDP CRLs. -user Use the HKEY_CURRENT_USER keys or certificate store. -username username Use named account for SSL credentials. For selection UI, use -username. -ut Display user templates. -v Provide more detailed (verbose) information. -v1 Use V1 interfaces.
Hash algorithms: MD2 MD4 MD5 SHA1 SHA256 SHA384 SHA512.
For more examples of how to use this command, see the following articles:
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.3