How to Use the certutil Command in Windows 11 to Manage Certificates and Verify File Hashes

Windows system administrators, security engineers, and DevOps professionals frequently require rapid, scriptable methods to inspect cryptographic certificates, audit root trust stores, verify file integrity, and validate revocation lists. While the graphical Microsoft Management Console (certmgr.msc and certlm.msc) facilitates manual inspections, headless automation and fleet orchestration necessitate a command-line interface. The native certutil.exe utility in Windows 11—originally developed for Active Directory Certificate Services (AD CS)—provides a comprehensive toolkit for managing local certificate stores, querying Certificate Revocation Lists (CRLs), encoding data, and computing high-assurance cryptographic file hashes without installing third-party utilities.

Certutil Functional Capabilities and Cryptographic Matrix

Understanding the broad operational scope of certutil.exe enables engineers to leverage its functions for security auditing and daily maintenance. The table below delineates the primary command verbs and their cryptographic roles:

Certutil Command Verb	Primary Technical Function	Administrative Context	Elevated Privileges Required
-hashfile	Calculates cryptographic checksums (SHA256, SHA512, MD5).	Verifying downloaded software ISOs and deployment scripts against supplier hashes.	No; standard user execution.
-store	Dumps and filters certificates held in local machine or user stores.	Auditing installed personal, corporate, and enterprise root certificates.	No for user stores; Yes for machine stores.
-addstore	Installs an X.509 certificate into a designated certificate store.	Deploying internal enterprise Root CAs or intermediate SSL/TLS certificates.	Yes (Administrator).
-delstore	Removes a compromised or expired certificate from the store.	Revoking unauthorized root authorities or cleaning retired signing keys.	Yes (Administrator).
-verify -urlfetch	Performs full certificate chain validation and fetches live CRL/OCSP status.	Troubleshooting smart card authentication or broken HTTPS trust handshakes.	No.
-encode / -decode	Converts binary data to Base64 PEM format and vice-versa.	Sanitising SSL certificates and cryptographic payloads for script pipelines.	No.

Verifying File Hashes with certutil -hashfile

Before executing downloaded binaries or deploying driver packages across a corporate network, calculating cryptographic hashes confirms that the file was not corrupted in transit or maliciously tampered with.

1. Computing SHA256 and SHA512 Hashes

To calculate the SHA256 checksum of an installation binary:

certutil -hashfile "C:\Downloads\Ubuntu-Server.iso" SHA256

To calculate a 512-bit hash for higher-assurance validation:

certutil -hashfile "C:\Downloads\FirmwareUpdate.bin" SHA512

2. Sanitising Output for Automated Script Validation

By default, certutil prints introductory banners and completion messages. To parse strictly the raw hexadecimal string in PowerShell automation pipelines, filter out whitespace and headers:

(certutil -hashfile "C:\Tools\agent.exe" SHA256)[1] -replace '\s',''

Managing Local and Machine Certificate Stores

Windows segregates certificates between the current interactive user (user) and the local operating system (machine). Understanding store naming is essential for proper targeting.

1. Common Certificate Store Identifiers

• My: Personal certificate store; houses certificates with matching private keys used for S/MIME email encryption, code signing, and client TLS authentication.
• Root: Trusted Root Certification Authorities; holds self-signed anchor certificates representing ultimate trust.
• CA: Intermediate Certification Authorities; contains cross-signing and issuing subordinate CAs.
• Disallowed: Untrusted Certificates; contains revoked or explicitly untrusted certificates.

2. Querying Installed Certificates

To inspect all certificates installed in the machine’s Trusted Root store:

certutil -store Root

To inspect certificates belonging specifically to the logged-in user’s personal store:

certutil -user -store My

To search for a certificate matching a specific Subject Common Name or Serial Number, append the search string:

certutil -store Root "DigiCert"

Installing and Removing Certificates via the Command Line

Automated software deployments often require enrolling private enterprise root certificates onto endpoints without displaying interactive GUI confirmation prompts.

1. Adding an Enterprise Root Certificate

Launch an elevated Administrator Terminal and run:

certutil -addstore Root "C:\Certs\CorpInternalRootCA.cer"

Certutil reads the X.509 structure, imports the public key, and returns: “CertUtil: -addstore command completed successfully.”

2. Installing an Intermediate CA

To install an issuing intermediate certificate into the machine’s intermediate store:

certutil -addstore CA "C:\Certs\CorpIssuingCA.cer"

3. Deleting a Certificate by Serial Number

If a certificate expires or must be excised immediately, delete it using its unique hexadecimal serial number:

certutil -delstore Root "4a12b3c4d5e6f708"

Testing Certificate Chains and Revocation Status

When an application fails to establish an SSL/TLS connection, certutil -verify performs a complete cryptographic path validation, parsing Authority Information Access (AIA) and querying Online Certificate Status Protocol (OCSP) responders or Certificate Revocation Lists (CRLs).

certutil -verify -urlfetch "C:\Certs\WebServerCert.cer"

Diagnostic analysis:

• The -urlfetch parameter instructs certutil to actively query remote HTTP/LDAP endpoints specified in the certificate’s CDP (CRL Distribution Point) extension.
• Review the terminal output: verify that each intermediate certificate resolves to a trusted root anchor, and confirm that the leaf certificate revocation check returns Verified (0).

Encoding and Decoding Cryptographic Payloads

Certutil provides native Base64 transcoding capabilities, allowing administrators to convert raw binary certificates or files into ASCII PEM blocks for configuration files:

# Encode raw binary DER certificate to Base64 PEM text
certutil -encode "C:\Certs\cert.der" "C:\Certs\cert.pem"

# Decode Base64 text file back to binary
certutil -decode "C:\Certs\cert.pem" "C:\Certs\cert_restored.der"

Security Considerations: LOLBIN Mitigation

Because certutil.exe contains a legacy -urlcache -split -f parameter capable of downloading files from arbitrary HTTP URLs, threat actors historically abused certutil as a “Living off the Land Binary” (LOLBIN) to download payloads onto compromised endpoints. Security best practices include:

• Monitoring Command-Line Telemetry: Configure Windows Defender Application Control (WDAC) or EDR agents to flag instances where certutil.exe is invoked alongside -urlcache or -split.
• Restricting User Rights: Prevent standard unprivileged users from executing certutil network requests across corporate firewalls.

Troubleshooting Common certutil Administrative Errors

When working with certificate stores, watch out for the following operational caveats:

• Access is Denied (Error 0x80070005): Occurs when attempting to run -addstore or -delstore against the machine store (Root, CA) from a non-elevated command prompt. Always initiate the terminal via Run as Administrator.
• The System Cannot Find the File Specified (Error 0x80070002): Verify that the path to your certificate file is enclosed in quotation marks if it contains spaces, and verify that the file extension is valid (.cer, .crt, .der, or .pfx).
• Revocation Server Offline: If -verify -urlfetch returns a revocation server unavailable error, inspect network proxy settings or firewalls blocking outbound HTTP communication to the CA’s CRL distribution server. Note that CRL endpoints typically run on unencrypted HTTP (port 80) rather than HTTPS to prevent circular TLS dependency deadlocks.