How to Manage, Import, and Export Certificates in Windows 11 Using PowerShell

Public Key Infrastructure (PKI) certificates are fundamental to secure computing in Windows 11 environments. Digital certificates underpin Transport Layer Security (TLS/SSL) encryption, code signing verification, Secure Sockets Layer VPNs, smart card authentication, and network access control (802.1X). In enterprise environments, system administrators frequently need to deploy internal Root Certification Authority (CA) certificates, audit expiring certificates, or export public keys across fleets of workstations.

While the graphical Microsoft Management Console (MMC) Certificates snap-in (certmgr.msc for Current User and certlm.msc for Local Machine) is common for manual inspection, it cannot scale across automated deployment pipelines. In modern Windows 11, PowerShell includes a native virtual drive provider (Cert:) and the specialized PKI module. Cmdlets such as Get-ChildItem Cert:\, Import-Certificate, Export-Certificate, and Export-PfxCertificate give administrators complete programmatic control over X.509 certificates.

Navigating the PowerShell Certificate Provider (Cert:\)

PowerShell treats the Windows Certificate Store as a virtual filesystem drive. Open an elevated PowerShell prompt and explore the certificate stores using standard filesystem navigation cmdlets:

# List root certificate store categories
Get-ChildItem -Path Cert:\

The provider exposes two primary root locations:

• Cert:\CurrentUser\: Certificates associated exclusively with the currently logged-in user profile (personal encryption keys, user S/MIME certificates).
• Cert:\LocalMachine\: Certificates applied system-wide to all user sessions and services running on the machine (computer authentication, trusted enterprise root authorities).

Common sub-stores include:

• Root: Trusted Root Certification Authorities.
• CA: Intermediate Certification Authorities.
• My: Personal certificates holding private keys for the host.
• Disallowed: Untrusted and revoked certificates.

Auditing and Searching Certificates

To inspect certificates in the Local Machine Personal store:

Get-ChildItem -Path Cert:\LocalMachine\My | Select-Object Subject, Thumbprint, NotAfter, HasPrivateKey | Format-Table -AutoSize

Finding Expiring Certificates

To identify all certificates expiring within the next 30 days to prevent service outages:

$expirationThreshold = (Get-Date).AddDays(30)
Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.NotAfter -le $expirationThreshold } | 
    Select-Object Subject, NotAfter, Thumbprint

Searching for a Certificate by Thumbprint

The SHA-1 thumbprint is the primary unique identifier for any certificate. Query a specific certificate directly:

$cert = Get-Item -Path "Cert:\LocalMachine\My\7F9D1E85A62B4C9D998CD14B821A79B200000001"

Importing Certificates Using Import-Certificate

The Import-Certificate cmdlet imports public-key certificates (formats such as .cer, .crt, or .p7b) into a target store. Importing into the LocalMachine store requires administrative privileges.

1. Installing a Trusted Enterprise Root CA Certificate

When connecting workstations to an internal enterprise network with private SSL/TLS services, install the root certificate into the Trusted Root Certification Authorities store:

$certPath = "C:\Certs\CorporateRootCA.cer"
Import-Certificate -FilePath $certPath -CertStoreLocation "Cert:\LocalMachine\Root"

2. Installing an Intermediate CA Certificate

$intermediatePath = "C:\Certs\CorporateIntermediateCA.cer"
Import-Certificate -FilePath $intermediatePath -CertStoreLocation "Cert:\LocalMachine\CA"

The console confirms the thumbprint and subject of the newly installed certificate.

Importing Private Key Certificates (PFX / PKCS#12)

When deploying server certificates containing private keys (.pfx or .p12 files), use the dedicated Import-PfxCertificate cmdlet, which supports password decryption:

$pfxPath = "C:\Certs\WebServerCert.pfx"
$password = Read-Host -Prompt "Enter PFX password" -AsSecureString

Import-PfxCertificate -FilePath $pfxPath -CertStoreLocation "Cert:\LocalMachine\My" -Password $password -Exportable

(The -Exportable parameter marks the private key as re-exportable if required by application backup policies).

Exporting Public Certificates Using Export-Certificate

To export a certificate’s public key from the Windows store to a file for distribution to external partners or web clients:

$thumbprint = "7F9D1E85A62B4C9D998CD14B821A79B200000001"
$cert = Get-Item -Path "Cert:\LocalMachine\My\$thumbprint"

# Export as DER-encoded binary (.cer)
Export-Certificate -Cert $cert -FilePath "C:\Certs\ExportedCert.cer" -Type CERT

To export in standard Base64-encoded ASCII (PEM) format instead of binary DER, use the .NET cryptographic provider directly:

$pemContent = "-----BEGIN CERTIFICATE-----`r`n" + 
    [System.Convert]::ToBase64String($cert.RawData, "InsertLineBreaks") + 
    "`r`n-----END CERTIFICATE-----"
$pemContent | Out-File -FilePath "C:\Certs\ExportedCert.pem" -Encoding ascii

Exporting Certificates with Private Keys (PFX)

To back up a personal certificate and its associated private key to an encrypted PFX archive:

$thumbprint = "7F9D1E85A62B4C9D998CD14B821A79B200000001"
$cert = Get-Item -Path "Cert:\LocalMachine\My\$thumbprint"
$pfxPassword = Read-Host -Prompt "Enter backup password for PFX" -AsSecureString

Export-PfxCertificate -Cert $cert -FilePath "C:\Certs\CertBackup.pfx" -Password $pfxPassword

Deleting Stale or Expired Certificates

To remove a revoked, expired, or decommissioned certificate from the store using PowerShell:

Get-Item -Path "Cert:\LocalMachine\My\7F9D1E85A62B4C9D998CD14B821A79B200000001" | Remove-Item

Managing certificates using PowerShell eliminates manual errors and provides a robust foundation for automated PKI governance across Windows 11 fleets.