Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I import a certificate, I'm offered the option to "automatically select the certificate store based on the type of certificate".

What basis does Windows use? Which types of certificate end up in which stores?

share|improve this question

Certificates are encoded with intended uses and I would assume those would be the best way to categorize the certificates.

Here's more info on the usages:

share|improve this answer
Is this just a guess? Neither of those links mention the store selection that this question is about. – Jon-Eric Apr 27 at 21:24
No, it is not a guess, a key has fields (that I linked to) that indicate the type of certificate it is and how it should be used. Windows can pretty accurately know where to store it based on that. For example, if it is a client certificate it will place it in the personal store. If the cert can be used to sign other certs it would like go in the Intermediate Certification Authorities store. – Mark Burnett Apr 29 at 23:15
I wonder if there's more to it. I just tried importing a client certificate whose sole Enhanced Key Usage is "Client Authentication (" and Windows automatically selected the Intermediate Certification Authorities store. In my case the decision seemed based on whether I had the associated private key, not the key usage. – Jon-Eric May 2 at 19:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.