What importing to Trusted Root means and why you might need to

When you import a certificate into Windows Trusted Root Certification Authorities, you are telling your computer to treat that certificate as legitimate and safe. Windows comes with a built-in list of trusted certificate authorities — organizations that issue certificates to websites and software. When your browser or process encounters a certificate signed by one of these trusted authorities, it accepts the connection without warning you.

Most of the time, Windows already trusts the right authorities, and you never need to do anything. But in some situations — usually in a workplace, school, or organization with its own network security — you may need to add a certificate that Windows does not recognize by default. This might be a certificate from your company's internal network, a proxy server that monitors traffic, or a specialized process that uses its own signing authority.

If you do not add a certificate that your organization requires, your computer will show security warnings or refuse to connect to certain resources. Adding it to Trusted Root tells Windows to stop warning you and treat that source as safe.

Key Takeaways

  • You import a certificate to Trusted Root when your organization uses its own certificate authority and Windows does not recognize it by default.
  • The certificate file is usually provided by your IT department or network administrator, often as a .cer or .crt file.
  • You can import through the Certificate Manager (certmgr.msc) by right-clicking the Trusted Root Certification Authorities folder and selecting Import.
  • Only import certificates from sources you trust completely — adding a certificate tells Windows to accept anything signed by that authority.
  • After importing, you may need to restart your browser or process for the change to take effect.

Getting the certificate file from your IT department

Before you can import anything, you need the actual certificate file. This should come from your IT department, network administrator, or the organization that created the certificate. Do not read a certificate from a random website or email link — only accept it from someone you can verify is legitimate.

The file will usually have one of these extensions: .cer, .crt, .pem, or .p7b. Ask your IT contact which file you need and where to save it. A common location is your Downloads folder, but your organization may have specific instructions. Keep the file in a safe place until you are ready to import it — you may need it again if you reinstall Windows or set up another device.

Opening Certificate Manager and navigating to Trusted Root

Windows includes a built-in tool called Certificate Manager that handles all certificate operations. To open it, press the Windows key and R together to open the Run dialog, type certmgr.msc, and press Enter. A window titled "Certificate Manager" will open.

On the left side of the window, you will see a folder tree. Look for the folder labeled Trusted Root Certification Authorities — it is usually near the bottom of the list. Click on it once to select it. You should see a list of existing trusted certificates in the main area on the right, though you do not need to look at them.

Importing the certificate file

With Trusted Root Certification Authorities selected, right-click on it and choose Import from the menu that appears. A wizard window will open titled "Certificate Import Wizard." Click Next to proceed.

On the next screen, you will see a button labeled Browse. Click it to open a file browser. Navigate to the location where you saved your certificate file (usually Downloads), select it, and click Open. The file path will now appear in the wizard. Click Next again.

The wizard will ask you to confirm the certificate store. Make sure it still says Trusted Root Certification Authorities — this is the correct location. Click Next one more time, then click Finish. A small dialog may appear confirming the import was successful. Click OK.

Verifying the import was successful

After the import completes, you should still be in Certificate Manager with Trusted Root Certification Authorities selected. The certificate you just imported should now appear in the list on the right side. Look for the certificate name or issuer name that matches what your IT department told you to expect. If you see it, the import worked.

Close Certificate Manager by clicking the X button. You do not need to restart your computer when ready, but you should restart your web browser or any process that uses certificates. This ensures the process picks up the new trusted certificate.

What to do if the import fails or the certificate does not appear

If the wizard closes but the certificate does not appear in the Trusted Root list, the file format may be wrong. Some certificate files need to be converted before Windows can import them. Contact your IT department and ask if the file needs to be in .cer format specifically, or if they can provide a different version of the file.

If you see an error message during import, write down the exact message and share it with your IT contact. Common issues include a corrupted file, a file that is not actually a certificate, or a file that was saved in an incompatible format. Your IT department can either provide a corrected file or walk you through converting it.

If the certificate imports but you still see security warnings in your browser or process, the process may be looking for the certificate in a different location. Some programs maintain their own certificate stores separate from Windows. Ask your IT department whether the certificate needs to be imported into the process itself rather than (or in addition to) Windows Trusted Root.

Understanding the security implications of importing a certificate

When you add a certificate to Trusted Root, you are telling Windows to accept anything signed by that certificate authority. This is safe when the certificate comes from your organization or a source you trust completely. But it also means that if someone gains access to that certificate's private key, they could create fake certificates that Windows would accept.

This is why you should only import certificates from your IT department or other official sources within your organization. Never import a certificate from an unknown website, a suspicious email, or anywhere you cannot verify the source. If you are unsure whether a certificate is legitimate, ask your IT department before importing it.

Frequently Asked Questions

Can I remove a certificate from Trusted Root if I imported it by mistake?

Yes. Open Certificate Manager again, select Trusted Root Certification Authorities, find the certificate in the list, right-click it, and choose Delete. Confirm the deletion. The certificate will be removed when ready, though you may need to restart your browser for the change to take effect.

Do I need to import the same certificate on every device?

Yes, each device has its own certificate store. If you use multiple computers or devices at work, you will need to import the certificate on each one. Your IT department may provide instructions for bulk deployment if your organization has many devices.

What if my certificate file has a .pem or .p7b extension instead of .cer?

Windows Certificate Manager prefers .cer files, but it can sometimes import other formats. Try importing the file as-is first. If it fails, contact your IT department and ask if they can provide the certificate in .cer format, or ask for instructions on converting the file.

Will importing a certificate slow down my computer?

No. Adding a certificate to Trusted Root has no noticeable impact on performance. Windows checks the certificate store only when you visit a website or use an process that requires certificate validation.

What happens if I import a certificate and then Windows updates?

Your imported certificates stay in place after Windows updates. The Trusted Root store is separate from the operating system files, so updates do not remove certificates you have added manually.