Manage the Windows certificate store
The personal certificates of the current user and of the computer, in two tabs - with details, renewal as a new CSR, export in the formats a server needs, and import of the certificate your CA issued, matched to its key automatically.
Version 1.1.2 · 27 October 2026 · Windows x64 · free · Download the aethercert Toolkit
The certificate store, with the jobs around it
certmgr.msc and certlm.msc show the store; the Toolkit adds the work that comes with it. Select a certificate and see identity, validity, names, issuer, cryptography and fingerprints, with weak keys and signatures flagged. Renew it, export it, copy it as PEM or delete it together with its key.
Import takes the file the CA returned - .cer, .crt, .pem or .p7b - and finds the private key from Create CSR by itself: in the Windows key store, in this session or in a saved .key file. The certificate goes into Personal, intermediates into Intermediate Certification Authorities, and a root is never installed implicitly.
A certificate's life in the store
- 01
Find it
User and computer tabs with filters and search. The computer store is read-only until you restart the app as administrator.
- 02
Renew
Create CSR from the selected certificate: same type, subject, names and key type, with a new key.
- 03
Import the issued certificate
The matching key is found automatically; a .pfx imports too.
- 04
Export
Presets for Windows / IIS / Exchange, nginx / Apache / HAProxy and certificate only - every file in one go.
What the certificate manager does
User and computer store
Both personal stores side by side, with a status column and flags for weak keys and signatures.
Details that matter
Identity, validity, names, issuer, cryptography and fingerprints, each with a copy button.
Import with key matching
The issued certificate is linked to its key by the SHA-256 of the public key, without certreq -accept.
Export presets
.pfx with chain and key (optionally 3DES), .cer, .crt, full chain, chain only and .key, in one step.
Non-exportable keys respected
A key Windows marks as not exportable - or one on a smart card or HSM - stays where it is; only the certificate exports.
Delete with the key
Removing a certificate removes its private key too, so no orphaned keys are left in the store.
The certificate store from PowerShell
actk store lists, imports, exports and deletes the same certificates - --machine selects the computer store from an elevated prompt.
actk store listactk store import issued.p7b --key www_example_com.keyactk store export 0123ABCD... --pfx www.pfx --fullchain fullchain.pemactk store list --machineMore tools in the Toolkit
Documentation
Frequently asked questions
Certificate manager
How do I import a certificate with its private key?
If the CSR came from the Toolkit, import the issued .cer, .crt, .pem or .p7b - the key is found automatically. Otherwise import a .pfx, which carries the key, or choose the .key file.
Why can I not export the private key?
Windows marked the key as not exportable when it was created or imported, or it lives on a smart card or HSM. Then only the certificate can be exported; for a PFX, create a new CSR with an exportable key.
Do I need administrator rights?
Not for your own certificates. The computer store (LocalMachine) is shown read-only and becomes writable when you restart the app as administrator.
Does it replace certmgr.msc?
For personal certificates, largely: list, details, import, export, renew and delete. It does not manage trusted root stores and never installs a root certificate on its own.
Tired of watching expiry dates in the store?
aethercert renews certificates before they expire and installs them where they are used - on Windows and Linux servers alike.
Community plan, no card required. Open registration - your account is ready in a few minutes.