How to View and Manage Security Certificates in Microsoft Edge

Public Key Infrastructure (PKI) and digital security certificates form the bedrock of encrypted web browsing. Whenever you visit an HTTPS website in Microsoft Edge, the browser validates the server’s SSL/TLS certificate against a trusted store of root Certificate Authorities (CAs). If a connection fails validation, or if you need to authenticate against internal enterprise intranets using personal client certificates, understanding how to view, inspect, and manage digital certificates in Microsoft Edge is essential for network troubleshooting and security management.

How to Inspect an Active Website’s SSL/TLS Certificate

You can verify any website’s cryptographic credentials directly from the Microsoft Edge address bar:

1. Navigate to the HTTPS website whose certificate you want to inspect.
2. Click the Padlock icon (or tune/sliders icon on newer builds) located to the immediate left of the website’s URL in the address bar.
3. In the security overview flyout, click Connection is secure.
4. Click the Certificate icon (resembling a small badge or document with a seal) located in the upper-right corner of the connection dialogue.
5. The Certificate Viewer modal opens, displaying three comprehensive diagnostic tabs:
   • General: Outlines the Common Name (CN), issuing Certificate Authority, and the formal validity date window.
   • Details: Lists cryptographic parameters including the signature algorithm (such as SHA-256 with RSA Encryption), public key length, serial number, and Subject Alternative Names (SANs) covering domains and subdomains.
   • Certification Path: Visualises the full trust chain from the end-entity certificate through intermediate CAs up to the root anchor.

Managing the System and Edge Certificate Store

While Edge on Linux and Android manages an internal NSS database, Edge on Windows delegates certificate store management directly to the Windows CryptoAPI (CAPI) certificate subsystem:

1. Open Microsoft Edge and click the three-dot menu (…) in the top-right corner, then select Settings.
2. In the left-hand navigation pane, select Privacy, search, and services.
3. Scroll down to the Security heading and click Manage certificates.
4. The native Certificates management dialogue box launches, categorised by specific purpose tabs:
   • Personal: Houses your client-side digital identity certificates, often issued by corporate VPNs or smart card middleware for client authentication.
   • Trusted Root Certification Authorities: Contains the master root certificates pre-installed by Microsoft or distributed via Active Directory Group Policy.
   • Intermediate Certification Authorities: Stores subordinate CA certificates that sign website certificates.
   • Untrusted Certificates: Catalogs revoked, compromised, or explicitly blocked root certificates.

How to Import Custom Root or Client Certificates

If your organization runs an internal private CA, or you are testing local development servers over HTTPS, you may need to import custom certificates into Edge:

1. Within the Certificates window, click on the appropriate tab (such as Trusted Root Certification Authorities for private CA roots, or Personal for client authentication certs).
2. Click the Import… button to start the Certificate Import Wizard.
3. Click Next, then click Browse… to locate your certificate file. Supported formats include .cer, .crt, .pfx, and .p12 containers.
4. If importing a private key container (.pfx), enter the encryption password configured during export.
5. Select Automatically select the certificate store based on the type of certificate or manually assign the specific store.
6. Click Finish. If installing a root certificate, accept the Windows security warning confirming you trust the issuer.

Exporting and Backing Up Digital Certificates

To transfer an existing digital certificate to another computer or preserve a backup before system reinstallation:

1. In the Certificates dialogue, select the certificate you need to duplicate.
2. Click Export… to launch the Certificate Export Wizard.
3. Choose whether to export the private key (available only for personal certificates):
   • Yes, export the private key: Packages the certificate into an encrypted .pfx file protected by a password.
   • No, do not export the private key: Produces a standard public .cer or Base-64 encoded file suitable for server configuration.
4. Select your destination directory, assign a filename, and complete the wizard.

Troubleshooting Certificate Revocation and Expiry Errors

If Edge displays connection warnings such as NET::ERR_CERT_COMMON_NAME_INVALID or NET::ERR_CERT_DATE_INVALID:

• Verify Local Time: An incorrect system clock or time zone causes Edge to perceive valid certificates as expired or not yet valid. Ensure Windows time synchronization is enabled.
• Check CRL and OCSP Availability: Enterprise firewalls or proxy servers blocking Certificate Revocation List (CRL) distribution points or Online Certificate Status Protocol (OCSP) endpoints will trigger revocation verification timeouts.
• Inspect Intermediary Proxies: Antivirus suites or corporate inspection proxies performing SSL decryption can inject untrusted certificates. Importing the software vendor’s root certificate into the Trusted Root store resolves these artificial browser warnings.