Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On Windows 2012 R2, winhttpcertcfg -i FileName -a CertAccount -c LOCAL_MACHINE\MY -p Password installs the certificate on Trusted Root Store instead of LOCAL_MACHINE\MY. I also need to grant access to the private key to an account specified by the -a option. Is there a way to achieve the same using Powershell / CertUtil ?

share|improve this question
up vote 1 down vote accepted

Winhttpcertcfg does not import certificates correctly on Server 2008 R2 and onwards. The download page says it is compatible upto Server 2003. See

The alternative command is certutil.

What is missing is a tool that takes arguments like Winhttpcertcfg that can take a parameter to which store you want to install to. Certutil cannot do that.

See answer by jaspernygaard

Winhttpcertcfg does allow granting access to accounts which certutil does not do and it works on Server 2008 R2 to Server 2012 R2 via the -g parameter.


The only option to import a certificate and grant permissions to an account is using Powershell. See Answer by mao47 for simple import of certificate using Powershell

See answer for importing and granting access using Powershell

If you want to write a tool then use C#


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.