Knowledge Base

How to install and bind a server certificate using certutil on Windows

Updated on June 13, 2026

Overview

By the end of this guide, you will have installed your intermediate and server certificates into the Windows Certificate Store with certutil, confirmed the server certificate is linked to its private key, verified the trust chain, and bound the certificate to a Windows service for HTTPS. It covers the prerequisites (including that the Certificate Signing Request, or CSR, was generated on this server), installing the certificates, verifying and repairing the private-key association, verifying the chain, confirming the result in the Microsoft Management Console (MMC), and binding examples for Internet Information Services (IIS) and HTTP.sys services.

Prerequisites

You are logged in to the target Windows server with Local Administrator privileges

The certificate files are on the server: the server certificate (for example, your_domain.cer) and the intermediate certificate(s) from the Certificate Authority

The private key already exists on this server (the Certificate Signing Request, or CSR, was generated here)

Step 1: Install the intermediate certificate(s)

Install intermediates first so Windows can build a complete trust chain. Open Command Prompt as Administrator and run:

certutil -addstore CA intermediate_certificate.cer

Expected result: the intermediate certificate is added to the Intermediate Certification Authorities store.

Step 2: Install the server certificate

In the same Administrator Command Prompt, run:

certutil -addstore MY server_certificate.cer

Expected result: the server certificate appears in the Personal (MY) certificate store.

Step 3: Verify the certificate has a private key

List the certificates in the Personal store, locate your certificate by Subject or Serial Number, and confirm the output includes "Private key is present":

certutil -store MY

Step 4: Repair the certificate (if required)

If the certificate does not show a private key but the key exists on the server, note the certificate Serial Number from the previous output and reassociate it, then rerun certutil -store MY to confirm:

certutil -repairstore MY "SerialNumber"

Step 5: Verify the certificate chain

Confirm the chain is complete and trusted (the output should end with "Certificate is valid"):

certutil -verify -urlfetch server_certificate.cer

Step 6: Verify using Certificate Manager (MMC)

Press Win + R, type mmc, and click OK.

Go to File > Add/Remove Snap-in and add Certificates for the Computer account.

Go to Personal > Certificates, select your certificate, and confirm a key icon is present and the Certificate Path tab shows no errors.

Step 7: Bind the certificate to a service

Bind the certificate to the service that will use HTTPS.

Example A — Internet Information Services (IIS):

Open IIS Manager and select the target website.

Click Bindings, then add or edit an HTTPS binding.

Select the installed certificate, click OK, and restart the site if prompted.

Example B — HTTP.sys / Windows service: applications that rely on HTTP.sys bind certificates using a certificate thumbprint. Common binding elements are the IP address and port (for example, 0.0.0.0:443), the certificate thumbprint, and the certificate store name (MY). Refer to your application or vendor documentation for the exact binding command.

Completion

Your server certificate is now installed in the Windows Certificate Store, linked to its private key, validated with a complete trust chain, and bound for HTTPS use.