CA certificate directory on Windows

Question

I make a network client in C and normaly I work with linux and I don't know how work CA certificate on windows. And the windows manual is not very good.

A CA certificate directory (root) exist by default on windows?

Like the directory /etc/ssl/certs/ under linux, which is a list of CA certificate.

I need this for adapted a programme which work with openSSL.

can you help me? Thank you in advance.

Is there any way to correct the address of the certificate directory known by openssl other than by reinstalling openssl? Environment variables don't seem to work. — David Spector, Jul 22 '22 at 16:42

score 1 · Answer 1 · answered Nov 13 '14 at 07:16

I don't believe Windows stores your Certificates in a default file location, but rather in a registry entry. Check out this link - it's for Windows Server 2003, but I believe most of the information is still relevant.

The basic tools typically used to manage certificates are Certreq.exe and Certutil.exe.

Here is a basic C++ program example for how to insert/create a certificate for Windows. It does not address the network portion of your question, but I think you might find it useful.

Good luck.

score 1 · Answer 2 · answered Nov 15 '14 at 22:12

A CA certificate directory (root) exist by default on windows? Like the directory /etc/ssl/certs/ under linux, which is a list of CA certificate.

No. You must provide a file with root and intermediate certificates with your app on Windows. It can be from Linux or you can export nessecity certificates from Windows Store manually through certmgr. Or you can create a list of trusted root and intermediate certificates programmatically with help's of WinAPI like Qt does, for example.

Actually, Windows® does have a system-wide certificate store, and one per user. They do not lie in the filesystem, however. — mirabilos, Nov 15 '14 at 22:42

score 1 · Accepted Answer · answered Jan 30 '15 at 21:11

you can acces to the Windows certificate store (which contain CA cert) and manipulate certificate whith this functions:

CertOpenSystemStore()
CertEnumCertificatesInStore()
CertCloseStore()

and convert DER certificate to OpenSSL X509 structure with:

d2i_X509()

for exemple, see in this link:

TLS client:

.

CA certificate directory on Windows

3 Answers3

Linked