What is CerUtil in Windows ?

  

The CertUtil  command      is a versatile command-line tool used in Windows systems to manage certificate information. It is part of Certificate Services and allows you to perform various certificate-related tasks, such as:

1. Making a backup: It is always a good idea to make a backup of your current configuration before making any changes. You can use the command  certutil -backup to make a backup.

• To back up Certificate Authority (CA) components using  CertUtil command , you can use the following command:

1. Creating a backup :

   certutil -backupDB <path to backup folder>
   certutil -backupKey <path to backup folder>

   • certutil -backupDB creates a backup of the CA database.
   • certutil -backupKey creates a backup of CA private keys.

   Make sure you provide the correct path to the folder where you want to store your backups.

2. Restoring a backup :

   certutil -restoreDB <path to backup folder>
   certutil -restoreKey <path to backup folder>

   • certutil -restoreDB restores the CA database from a backup.
   • certutil -restoreKey restores CA private keys from a backup.
2. Checking the Certificate Store (CA) Configuration : You can get detailed information about the CA configuration, which is useful for IT administrators.

• Examples :

  1. Displaying the list of certificates in the local store :

     certutil -store My

  2. Displaying the list of certificates in the certification authority store :

     certutil -store CA

  3. Displaying the list of certificates in the Trusted Root Certification Authorities store :

     certutil -store Root

  4. Displays CA configuration information with more detailed options :

     certutil -viewstore My

3. Configuring Certificate Services : CertUtil allows you to configure various aspects of certificate services.

• To configure certificate services using the  CertUtil command , you can use different commands depending on the specific task. Here are some examples:

  1. Installing a Certification Authority (CA) Certificate :

     certutil -installcert CertFile.cer

  2. Certificate template configuration :

     certutil -settemplate TemplateName

  3. CRL (Certificate Revocation List) configuration :

     certutil -crl

  4. Certification policy configuration :

     certutil -setreg policy\EditFlags +EDITF_ATTRIBUTEENDDATE

  5. Configuring Certification Authority Properties :

     certutil -setreg ca\ValidityPeriod "Years"
     certutil -setreg ca\ValidityPeriodUnits 5

  These commands allow for various aspects of configuring certificate services. Note that some of these operations may require administrative privileges.
4. Verifying certificates, key pairs, and certificate chains : CertUtil allows you to validate certificates and their chains.
• Here are some CertUtil commands   to verify certificates, key pairs, and certificate chains:

1. Certificate verification :

   certutil -verify CertFile.cer

   This command validates a certificate, including its trust chain.

2. Key pair verification :

   certutil -verifykeys CertFile.cer

   This command checks whether the public key in the certificate matches the private key.

3. Certificate chain verification :

   certutil -verifychain CertFile.cer

   This command checks the entire certificate chain to ensure that each certificate in the chain is valid and trusted.

4. View detailed certificate information :

   certutil -dump CertFile.cer

   This command displays detailed information about a certificate, such as its properties, keys, and other data.

5. File Encoding and Decoding : The tool allows you to encode files into Base64 or hexadecimal format and decode them.
• Here are some CertUtil commands   to encode and decode files:

1. Encoding file to Base64 format :

   certutil -encode InFile OutFile

   This command encodes the contents of a file  InFile to Base64 format and saves the result to a  OutFile.

2. Decoding Base64 file :

   certutil -decode InFile OutFile

   This command decodes the contents of a file  InFile from Base64 format and saves the result to a  OutFile.

3. Encoding file to hexadecimal format :

   certutil -encodehex InFile OutFile

   This command encodes the contents of a file  InFile into hexadecimal format and saves the result to a file  OutFile.

4. Decoding hex file :

   certutil -decodehex InFile OutFile

   This command decodes the contents of a file  InFile from hexadecimal format and saves the result to a file  OutFile.

Yes, you can safely use these commands to check and configure certificate services, but keep a few important things in mind:

1. Administrator Privileges : Some of these commands may require administrator privileges. Make sure you have the proper privileges before executing them.
2. Test Environment : If possible, test commands in a test environment before using them in production. This helps avoid unintended configuration changes.
3. Backups : It is always a good idea to make a backup of your current configuration before making any changes. You can use the command  certutil -backup to make a backup.

If these commands also do not provide the expected information, you may need to check your permissions or system configuration.

¹: Microsoft Learn