Where to find and delete certificates on your computer

Windows stores certificates in a central location called the Certificate Store, and you can remove them through the built-in Certificate Manager tool. The fastest way is to open the Run dialog (press Windows key + R), type certmgr.msc, and press Enter. This opens the Certificate Manager window where all your stored certificates appear in folders organized by type.

Once Certificate Manager is open, you will see folders on the left side: Personal, Trusted Root Certification Authorities, Intermediate Certification Authorities, and others. The certificate you want to remove will be in one of these folders. Click the folder, find the certificate in the list on the right, right-click it, and select Delete. Windows will ask you to confirm the deletion.

If you are not sure which folder contains your certificate, you can search by opening each folder and looking at the certificate names and dates. Certificates often show the issuer name (like "VeriSign" or "DigiCert") and the domain they protect, which makes them easier to identify.

Key Takeaways

  • The Certificate Manager tool (certmgr.msc) is the standard way to remove certificates from Windows without needing administrator knowledge.
  • Certificates are organized into folders by type, and you must find the correct folder before you can delete the one you want.
  • Right-clicking a certificate and selecting Delete removes it permanently from your computer.
  • Removing a certificate does not affect other programs or websites unless that certificate was specifically needed for authentication or security.
  • If you remove a certificate by mistake, you can reinstall it by obtaining it again from the issuer or the website that provided it.

Removing personal certificates you installed yourself

Personal certificates are ones you installed for a specific purpose — often for email signing, client authentication, or testing. These live in the Personal folder inside Certificate Manager. Open certmgr.msc, click the Personal folder on the left, and you will see all your personal certificates listed by name and expiration date on the right side.

To remove one, right-click it and select Delete. A confirmation dialog will appear asking if you are sure. Click Yes to remove it. The certificate is then deleted from your computer and cannot be recovered unless you have a backup copy or can read it again from the source.

If you are removing a certificate because it has expired or is no longer needed, deletion is safe. If you are removing it because you think it is causing a problem with a website or program, test that program or website after deletion to confirm the issue is resolved.

Removing trusted root and intermediate certificates

Root and intermediate certificates are issued by certificate authorities and are used to verify the authenticity of other certificates. Windows comes with many of these pre-installed, and websites and programs may add more over time. These certificates live in the Trusted Root Certification Authorities and Intermediate Certification Authorities folders.

Removing a root or intermediate certificate is riskier than removing a personal certificate, because doing so can break the trust chain for any website or program that relies on it. Before you delete one, make sure you understand why you are removing it. If a website or program stops working after you delete a root certificate, that is likely the cause.

To remove a root or intermediate certificate, open Certificate Manager, click the appropriate folder, right-click the certificate, and select Delete. If you are unsure whether a certificate is safe to remove, search the internet for the certificate issuer name — this will tell you what it is used for and whether other programs on your computer depend on it.

Removing certificates from the command line

If you prefer to work from the command line or need to remove many certificates at once, you can use the certutil tool. Open Command Prompt as Administrator (right-click Command Prompt and select Run as Administrator), then use the command certutil -delstore StoreName CertificateName to remove a specific certificate.

Replace StoreName with the name of the folder (such as "My" for Personal, "Root" for Trusted Root Certification Authorities, or "CA" for Intermediate Certification Authorities). Replace CertificateName with the name or thumbprint of the certificate you want to remove. You can find the thumbprint by opening Certificate Manager, right-clicking the certificate, selecting Properties, and looking for the Thumbprint field.

The command line method is faster if you know exactly which certificate you want to remove and you are comfortable typing commands. For most users, the Certificate Manager graphical tool is simpler and less error-prone.

What happens after you remove a certificate

Once a certificate is deleted, Windows no longer has it available for authentication or verification. If a website or program needs that certificate to work, you will see an error message the next time you try to use it. The error might say the certificate is untrusted, expired, or missing.

If this happens, you have two options: reinstall the certificate if you have a copy, or contact the website or program provider to obtain a new one. Many websites will automatically send you a new certificate when you visit them, so straightforward revisiting the site may solve the problem. For programs, you may need to reinstall the program or read the certificate from the provider's website.

Removing a certificate does not delete any files, emails, or data associated with it. It only removes the certificate itself from Windows' certificate store. If you signed emails with a certificate before deleting it, those emails remain signed and can still be read.

Removing expired or suspicious certificates

Expired certificates are safe to remove because they are no longer valid and Windows will not use them for new connections. You can identify expired certificates in Certificate Manager by looking at the Expiration Date column — any date in the past means the certificate has expired. Removing expired certificates does not affect your computer's security and can help keep your certificate store clean.

If you suspect a certificate is malicious or was installed without your permission, removing it is the right step. However, also run a malware scan on your computer to check for other signs of infection. Malicious certificates are sometimes installed by malware, so a single suspicious certificate may indicate a larger problem.

To find suspicious certificates, look for ones issued to unfamiliar companies or domains, or ones that were installed on dates you do not remember. If you are not sure whether a certificate is legitimate, search the internet for the issuer name and the domain it protects. This will usually tell you whether it is a known and trusted certificate or something unusual.

Backing up certificates before you delete them

If you think you might need a certificate again in the future, you can back it up before deleting it. In Certificate Manager, right-click the certificate, select All Tasks, and then Export. This opens the Certificate Export Wizard, which lets you save the certificate to a file on your computer.

You can choose to export the certificate with or without the private key, depending on what you need. If the certificate has a private key and you want to use it again later, you must export it with the key. The wizard will ask you to set a password to protect the exported file.

Store the exported file in a safe location, such as an external hard drive or cloud storage. If you ever need to reinstall the certificate, you can import the file back into Certificate Manager by right-clicking in the appropriate folder, selecting All Tasks, and then Import.

Frequently Asked Questions

Can I remove a certificate if I do not know what it is for?

You can remove it, but search the internet for the issuer name first. If it is a well-known certificate authority like VeriSign or DigiCert, it is probably safe to remove if you do not recognize it. If removing it breaks a website or program, you can reinstall it by visiting the website or reinstalling the program.

Will removing a certificate affect my internet browsing?

Only if the certificate was needed to verify a website you visit. Most websites use certificates issued by major certificate authorities that are already trusted by Windows, so removing a personal or expired certificate will not affect normal browsing. If you remove a root certificate, you may see security warnings on websites that rely on it.

What is the difference between deleting a certificate and disabling it?

Windows Certificate Manager does not have a disable option — you can only delete or keep a certificate. Deletion removes it completely. If you want to keep a certificate but prevent it from being used, your only option is to export it, delete it, and then import it again later if needed.

Can I recover a certificate after I delete it?

Only if you exported it to a file before deleting it. If you did not back it up, you will need to obtain it again from the website or program that provided it. Many websites will resend a certificate if you request it, and programs often reinstall their certificates when you reinstall the program.

Do I need administrator rights to remove a certificate?

For personal certificates, no. For root and intermediate certificates, yes — you must run Certificate Manager as Administrator. Right-click certmgr.msc and select Run as Administrator to open it with the necessary permissions.