How to Use the certutil Command in Windows 11 to Verify Certificates, Check Hashes, and Decode Base64 Files

While originally engineered as an administrative management utility for Active Directory Certificate Services (AD CS), the native certutil.exe executable included in Windows 11 functions as one of the most versatile command-line cryptographic tools on the operating system. Because it is pre-installed across all desktop and server Windows editions, security analysts, system administrators, and software developers routinely employ certutil for rapid offline cryptographic calculations without installing third-party utilities.

From generating SHA-256 and MD5 file hashes to verify software download integrity, to encoding and decoding Base64 binary payloads, to validating public-key certificates against Certification Authority (CA) revocation lists (CRLs), certutil provides essential command-line capabilities. This technical guide covers syntax rules, hash calculation procedures, Base64 conversion methods, and certificate chain verification workflows on Windows 11.

Command Overview: Everyday certutil Sub-Commands

While certutil contains hundreds of enterprise PKI parameters, these primary sub-commands handle everyday security administration:

Sub-Command	Primary Operational Function	Example Command
-hashfile	Calculates cryptographic message digest hashes (SHA256, SHA512, MD5, SHA1).	certutil -hashfile installer.exe SHA256
-encode	Converts a binary file into a Base64 encoded text file wrapped with PEM headers.	certutil -encode image.png encoded.txt
-decode	Decodes a Base64 text file back into its original binary representation.	certutil -decode encoded.txt restored.png
-verify	Validates an X.509 certificate against its root chain, expiration, and CRL distribution points.	certutil -verify cert.cer
-store	Dumps or inspects certificates residing in local Windows certificate stores.	certutil -store My

Step 1: Calculating and Verifying Cryptographic File Has Hashes

When downloading ISO images, software binaries, or firmware archives, verifying file hashes guarantees that the file was not corrupted during transit or tampered with by malicious actors:

Calculating a SHA-256 Hash

Open Command Prompt or PowerShell and execute:

certutil -hashfile "C:\Downloads\Ubuntu-24.04-live-server.iso" SHA256

Example terminal output:

SHA256 hash of C:\Downloads\Ubuntu-24.04-live-server.iso:
8762f1103a43233a016d997232...
CertUtil: -hashfile command completed successfully.

Calculating Alternate Hash Algorithms (SHA512 and MD5)

The -hashfile parameter accepts any standard hashing algorithm identifier:

# Calculate SHA-512 checksum
certutil -hashfile backup.zip SHA512

# Calculate MD5 checksum
certutil -hashfile legacy_payload.bin MD5

Step 2: Encoding and Decoding Files with Base64

Converting binary files into Base64 ASCII strings is essential when embedding certificates into JSON configurations, passing images through REST APIs, or transporting data across strict text-only channels:

Encoding a Binary File to Base64

certutil -encode "C:\Data\license.key" "C:\Data\license_base64.txt"

This generates a text file containing the Base64 representation enclosed within -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- headers.

Decoding a Base64 File to Binary

certutil -decode "C:\Data\license_base64.txt" "C:\Data\license_restored.key"

CertUtil strips the certificate headers, parses the Base64 stream, and reconstructs the bit-identical binary file.

Step 3: Inspecting Local Certificate Stores

To inspect certificates installed in your user account or local computer stores:

Viewing Personal User Certificates

certutil -store -user My

This enumerates all personal certificates installed for client authentication, S/MIME email encryption, or code signing.

Inspecting Root Certificates

To view certificates in the Trusted Root Certification Authorities store:

certutil -store Root

Step 4: Validating Certificate Chains and CRL Revocation

To diagnose why a web server or corporate application rejects an SSL/TLS certificate, use certutil -verify to audit the entire trust chain and query Online Certificate Status Protocol (OCSP) endpoints:

certutil -verify "C:\Certs\WebServerCert.cer"

The output traces every certificate link from the leaf certificate up through intermediate CAs to the trusted root. If a certificate is expired, missing an intermediate certificate authority, or listed on a Certificate Revocation List (CRL), CertUtil outputs the exact failure error code (such as CERT_E_UNTRUSTEDROOT or CRYPT_E_REVOKED).

Cybersecurity Context and Living-off-the-Land (LotL) Awareness

Because certutil.exe contains a -urlcache -split -f parameter capable of downloading files from remote HTTP/HTTPS URLs, threat actors frequently abuse CertUtil as a “Living-off-the-Land” binary (LoLBin) to download malicious payloads onto compromised endpoints:

• EDR Monitoring: Enterprise Endpoint Detection and Response (EDR) agents strictly monitor command-line executions of certutil containing -urlcache or http:// strings. When using certutil for administrative hash verification, ensure your scripts stick to -hashfile, -encode, or -verify to avoid triggering automated security alerts.
• PowerShell Alternative: In automated PowerShell scripts where external process execution is restricted, the native cmdlet Get-FileHash (e.g., Get-FileHash -Algorithm SHA256 ./file.iso) provides a pure .NET alternative.