I have a service (Running as local system) that uses an SSL connection. Currently this connection fails because the remote host used a private CA to sign it's certificate. For previous operating systems, I used to use the certificate manager to import the CA cert into the local machine's Trusted Root certificates store.

Though I can do the steps with a windows 7 machine, it seems after a reboot that the imported certificates are gone. Here are the steps I'm doing in Windows 7:

  1. Open mmc
  2. Add Certificates Snap-in for Local Machine
  3. Navigate to Third-Party Root Certification Authorities/Certificates
  4. Import Root CA Cert.

The certificate seems to work fine, using internet explorer or the service to test the SSL connection works, but after a reboot it seems like the change is reverted.

  • It sounds like you are importing things correctly. Are any group policies related to CAs being applied to your system? – Zoredache May 12 '10 at 19:37
  • Thanks for assisting. No, I'm trying it on a stand alone Windows 7 Enterprise workstation right now. In your experience, the certificate stays in the local machine store after rebooting (on win7)? – ReluctantAdmin01 May 12 '10 at 22:02

Silly question: Are you running the command as an administrator? Only a user with local administrator rights can modify the machine stores. Windows 7 should elevate the mmc.exe process automatically, but maybe it isn't for some reason?

Also, you may want to try adding them to the Trusted Root CA folder instead. Maybe the changes will stick for some random reason...

  • Thank you for the suggestions. The mmc is elevated. The certs stay around for a while too, so it gives me the impression that things are working ok. I'm currently thinking it's got something to do with either windows update or a scheduled task. – ReluctantAdmin01 May 17 '10 at 18:13

Try installing ssltools manager and then click your trust store from the drop down near the top of the app. Click anywhere in the explorer area and click the 'import' button. Then select your cert file and click submit. It's much easier and quicker than the mmc snap in or console commands.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy