Skip to content
QCecuring

Windows Certificate Store

Type: certstore-windows
Category: Certificate Store
Access Mode: AGENT
Produces: certificate, public-key

Reads certificates directly from the Windows Certificate Store using native Windows APIs. Requires the sensor to be running on a Windows machine.

What It Discovers

Section titled “What It Discovers”
  • All certificates in the specified store locations
  • Certificate chains and trust relationships
  • Certificate properties (subject, issuer, validity, key usage)
  • Public keys associated with stored certificates

Configuration

Section titled “Configuration”
storeLocation: LocalMachine
stores:
  - My
  - Root
  - CA
  - Trust

Config Fields

Section titled “Config Fields”
FieldTypeRequiredDefaultDescription
storeLocationstringNoLocalMachineStore location: LocalMachine or CurrentUser
storesstring listNoMy, Root, CA, TrustStore names to scan

Common Store Names

Section titled “Common Store Names”
StoreContents
MyPersonal certificates (server certs, client auth certs)
RootTrusted Root Certification Authorities
CAIntermediate Certification Authorities
TrustEnterprise trust certificates
TrustedPeopleExplicitly trusted end-entity certificates
TrustedPublisherTrusted software publishers

Requirements

Section titled “Requirements”
  • Sensor must be running on Windows
  • No additional configuration or permissions needed for LocalMachine (runs as the sensor service account)
  • CurrentUser reads the current user’s certificate store

Example Output

Section titled “Example Output”
  • Certificate: “webserver.corp.example.com” — RSA-2048, My store
  • Certificate: “DigiCert Global Root G2” — RSA-2048, Root store
  • Certificate: “Corp Internal CA” — EC-384, CA store

Tips

Section titled “Tips”
  • Default config works — Running with no config scans LocalMachine with the four standard stores. Good for most cases.
  • CurrentUser — Use when scanning developer workstations where personal certificates are relevant
  • Service account — The sensor’s Windows service account determines what LocalMachine certs are accessible
Section titled “Related”