Import a root certificate into Windows using the Certificate Manager
To import a certificate into your Trusted Root Certification Authorities store on Windows, you use the Certificate Manager — a built-in Windows tool that manages which root certificates your computer trusts. The process takes about five minutes and requires you to have the certificate file on your computer already.
The most common way is through the graphical Certificate Manager interface. You open it, navigate to the Trusted Root Certification Authorities folder, and tell Windows to import your certificate file into that folder. Windows then recognizes that certificate as trusted for all programs on your computer.
Before you start, make sure you have the certificate file itself. It is usually a file ending in .cer, .crt, .pem, or .pfx. If someone gave you a certificate and you are not sure what format it is, check the file extension or ask the person who provided it.
Key Takeaways
- Open Certificate Manager by typing certmgr.msc into the Windows Run dialog, then navigate to Trusted Root Certification Authorities.
- Right-click the Trusted Root Certification Authorities folder, select Import, and choose your certificate file from your computer.
- Windows will verify the certificate and ask you to confirm before adding it to the trusted store.
- After import, the certificate appears in your Trusted Root Certification Authorities list and is recognized by all programs on your computer.
- If you import a certificate by mistake, you can delete it from the same Certificate Manager window by right-clicking and selecting Delete.
Open Certificate Manager on your Windows computer
The fastest way to reach Certificate Manager is through the Run dialog. Press Windows key + R on your keyboard to open the Run box. Type certmgr.msc and press Enter. Certificate Manager opens when ready.
If the Run dialog does not work on your computer, you can also search for "Certificate Manager" in the Windows Start menu and click the result. Both methods open the same tool.
Certificate Manager shows your certificate stores in a folder tree on the left side. You will see folders like Personal, Trusted Root Certification Authorities, and others. The Trusted Root Certification Authorities folder is where you need to import your certificate.
Navigate to Trusted Root Certification Authorities and start the import
In the Certificate Manager window, look at the left panel. Click on the arrow or plus sign next to "Trusted Root Certification Authorities" to expand that folder. The folder opens to show any certificates already stored there.
Right-click directly on the "Trusted Root Certification Authorities" folder name. A menu appears with several options. Click on "Import" from that menu. The Certificate Import Wizard opens.
The wizard asks you to browse for the certificate file you want to import. Click the "Browse" button, navigate to wherever you saved your certificate file on your computer, select it, and click Open. The file path now appears in the wizard window.
Complete the import and confirm the certificate
After you select your certificate file, the wizard shows you a preview of the certificate details — the name, issuer, and validity dates. Review this information to make sure it is the certificate you intended to import. If something looks wrong, click Cancel and check that you selected the correct file.
If the certificate looks correct, click "Next" to continue. The wizard may ask you to confirm that you trust this certificate. This is a safety step — Windows wants to make sure you really intend to add this certificate to your trusted store. Read the warning carefully. If you are certain you want to trust this certificate, click "Yes" or "Finish" depending on what the wizard displays.
Windows imports the certificate and adds it to your Trusted Root Certification Authorities store. You should see a confirmation message. The certificate is now trusted by your computer and all programs running on it will recognize it as valid.
Verify the certificate was imported successfully
After the import completes, the Certificate Manager window is still open. Look at the list of certificates in the Trusted Root Certification Authorities folder. Your newly imported certificate should appear in that list, usually sorted alphabetically by the certificate name or issuer.
If you do not see your certificate in the list, the import may not have completed. Close Certificate Manager and repeat the import process, making sure you selected the correct file and confirmed the import at the final step.
You can double-click any certificate in the list to view its full details — the issuer name, subject, validity dates, and thumbprint. This is useful if you want to confirm that the right certificate was imported.
Remove a certificate if you imported it by mistake
If you import a certificate and later decide you no longer want to trust it, you can delete it from Certificate Manager. Open Certificate Manager again (Windows key + R, then certmgr.msc), expand the Trusted Root Certification Authorities folder, and find the certificate you want to remove.
Right-click on the certificate name and select "Delete" from the menu. Windows asks you to confirm the deletion. Click "Yes" to remove the certificate from your trusted store. The certificate is no longer trusted by your computer after this point.
Import a certificate using the command line instead
If you prefer to use the command line or need to import certificates on multiple computers, you can use the certutil command. Open Command Prompt as Administrator (right-click Command Prompt and select "Run as Administrator") and type the following command, replacing the file path with the location of your certificate:
certutil -addstore "Root" "C:\path\to\your\certificate.cer"
Press Enter and Windows imports the certificate into your Trusted Root Certification Authorities store. The command line method is faster if you are importing many certificates or automating the process on multiple computers. The certificate appears in Certificate Manager when ready after the command completes.
Frequently Asked Questions
What file formats can I import into Trusted Root Certification Authorities?
Windows accepts .cer, .crt, .pem, and .pfx files. The .cer and .crt formats are most common for root certificates. If your certificate is in a different format, you may need to convert it first using a tool like OpenSSL or ask the certificate provider for a compatible format.
Do I need administrator rights to import a certificate?
Yes, you need administrator rights on your Windows computer to import into the Trusted Root Certification Authorities store. If you do not have administrator rights, contact your IT department or computer administrator to import the certificate for you.
Will importing a certificate affect other users on my computer?
No. When you import a certificate into your personal Certificate Manager, it affects only your user account. Other users on the same computer have their own separate certificate stores. If you want the certificate trusted for all users, you need to import it into the system-wide certificate store, which requires administrator rights and a different process.
What happens if I import a certificate that is already expired?
Windows will import the expired certificate, but programs will not trust it because the validity period has passed. You should only import certificates that are currently valid. If you received an expired certificate by mistake, contact the certificate provider for a new one.
Can I undo an import if I change my mind?
Yes. Open Certificate Manager, find the certificate you imported in the Trusted Root Certification Authorities folder, right-click it, and select Delete. The certificate is removed from your trusted store when ready. Programs will no longer recognize it as valid.