Request and renew certificates with Certificates MMC

Applies to: ✅ Windows Server 2025, ✅ Windows Server 2022, ✅ Windows Server 2019, ✅ Windows Server 2016

Use the Certificates snap-in in Microsoft Management Console (MMC) to request or renew certificates through Active Directory Certificate Services (AD CS) enrollment policy on Windows Server 2025. Users and computers rely on certificates to authenticate and to secure communication, and every certificate expires. You request new certificates and renew existing ones to keep the applications and services that depend on them working without interruption.

This article covers the interactive user and local-computer enrollment workflows. It doesn't duplicate Certification Authority Web Enrollment procedures or Group Policy trust-distribution procedures.

Prerequisites

Before you request a certificate, make sure that:

The enterprise certification authority (CA) that issues the certificate publishes the template.
The requesting security principal has Read and Enroll permissions on the template. For a computer certificate, this principal is the computer object. The issuing CA also needs Read on the template. If you removed Authenticated Users from the template access control list (ACL), add each CA's computer account explicitly. See Certification Authority can't use a certificate template.
A domain-joined client that can reach Active Directory Domain Services (AD DS) and the issuing enterprise CA. This article uses the built-in Active Directory Enrollment Policy. Certificate Enrollment Policy Web Service (CEP) and Certificate Enrollment Web Service (CES) can support non-domain-joined clients when you configure them for that scenario, but that scenario is outside the scope of this article.
You know whether the application uses the current-user, local-computer, or a particular service-account certificate store.
You can supply any policy-approved request properties that the template requires.

Important

Administrative elevation doesn't replace template enrollment permissions. Use the requesting identity and certificate-store scope that the certificate's application requires.

Choose the certificate store scope

Use the scope that matches the identity that uses the private key.

Scope	Open it with	Use it for
Current user	`certmgr.msc`	A certificate for use in the signed-in user's context.
Local computer	`certlm.msc`	A certificate for use in the local computer's context, such as a computer-template certificate.
Service account	`mmc.exe`, then add the Certificates snap-in and select Service account	Inspecting or managing a named Windows service's store. Plan separately for the service runtime account to use the certificate's private key.

To add a local-computer Certificates snap-in manually, run mmc.exe, then select File > Add/Remove Snap-in > Certificates > Add > Computer account > Next > Local computer: (the computer this console is running on) > Finish > OK. The console tree shows Certificates (Local Computer).

Request a user certificate

Request a certificate into the signed-in user's store when an application runs in the user's context. This workflow uses the Certificate Enrollment wizard and the built-in Active Directory Enrollment Policy.

Sign in as the user who has Read and Enroll permissions on the published template.
Run certmgr.msc.
Expand Personal, select and hold (or right-click) Certificates, and then select All Tasks > Request New Certificate.
In the Certificate Enrollment wizard, on the Before You Begin page, select Next.
On the Select Certificate Enrollment Policy page, select the applicable policy, which is usually Active Directory Enrollment Policy, then select Next.
On the Request Certificates page, select the checkbox for the intended template, then select Enroll.
If the wizard shows More information is required to enroll for this certificate. Click here to configure settings., select the message. In Certificate Properties, complete only the template-required and policy-approved request properties, such as subject or subject alternative name values. Select OK, and then select Enroll.

After successful enrollment, the certificate appears in Personal > Certificates for the current user.

Create a custom or offline request with certreq

Use certreq when the certificate owner approves a request configuration file and the interactive template workflow can't express the required request. This path doesn't cover Certification Authority Web Enrollment or uploading a preexisting Public Key Cryptography Standards (PKCS) request to a web page.

Obtain an approved requestconfig.inf from the template or application owner. Don't copy cryptographic, identity, or exportability settings from an unrelated template.
Generate the request in the intended context:
```
certreq -new requestconfig.inf certrequest.req
```
For a local-computer certificate, the approved INF must specify MachineKeySet = TRUE. The -machine option sets the machine context for the request and must be consistent with that INF key and the template context:
```
certreq -new -machine requestconfig.inf certrequest.req
```

Submit the request to the approved CA:

certreq -submit certrequest.req certnew.cer

If the CA returns a pending disposition, record the request ID. After issuance, retrieve the certificate from the issuing CA:
```
certreq -retrieve <RequestID> certnew.cer
```
Accept and install the issued certificate in the same user or machine context as the original request:
```
certreq -accept certnew.cer
```
If no matching pending request exists in that context, add -user or -machine to certreq -accept to select the destination context.

Validate the installed certificate in the intended store and with the relying application. For command syntax and request-file guidance, see certreq.

Request a computer certificate

Request a certificate into the local-computer store for a computer-template certificate, such as one that a service uses in the computer context. You must grant template permissions to the computer object that needs the certificate.

On the target computer, run certlm.msc.
Expand Personal, select and hold (or right-click) Certificates, and then select All Tasks > Request New Certificate.
In the Certificate Enrollment wizard, on the Before You Begin page, select Next.
On the Select Certificate Enrollment Policy page, select the applicable policy, which is usually Active Directory Enrollment Policy, then select Next.
On the Request Certificates page, select the intended computer template and select Enroll.
Select Finish, then verify that the issued certificate appears in Personal > Certificates under Certificates (Local Computer).

For example, Microsoft documents local-computer enrollment for web-server templates and notes that you must grant template permissions to the computer object that needs the certificate. See Configure certificate templates for ML-DSA.

Note

Use an elevated session or an account authorized to manage the Local Computer certificate store. Elevation doesn't grant the computer account template permissions.

Renew a certificate with a new key

Use a new-key renewal when the template and application support it and you want the replacement certificate to use a newly generated key.

Open the store that contains the certificate: certmgr.msc for a user certificate or certlm.msc for a local-computer certificate.
Go to Personal > Certificates and select the existing certificate.
Select and hold (or right-click) the certificate, then select All Tasks > Renew Certificate with New Key.
In the Certificate Enrollment wizard, select Next.
On the Request Certificates page, confirm that the template is available, then select Enroll.
Select Finish when the renewal completes.

Note

All Tasks also lists Request Certificate with New Key and Renew Certificate with Same Key. Same-key renewal reuses the existing key pair, so choose it only when an approved application or enrollment design requires key reuse. Verify the template and application requirements before you renew a production certificate.

Decide whether same-key renewal is required

Use the new-key workflow in this article unless an approved application or enrollment design requires reuse of the existing key. In the documented Certificate Enrollment Policy Web Service and Certificate Enrollment Web Service scenario, a client renews a certificate through key-based renewal by using the key of its existing certificate for authentication, and the scenario's validation step renews the certificate with the same key from an MMC snap-in. Treat that as a scenario-specific workflow, not as a generic alternative for every template. For the required service and policy configuration, see Configure Certificate Enrollment Web Service for certificate key-based renewal.

Validate the issued or renewed certificate

After enrollment or renewal, validate both the certificate contents and its store location.

In Personal > Certificates, open the new certificate.
On the Details tab, verify the expected public key, signature algorithm, and Enhanced Key Usage (EKU).
On the Certification Path tab, verify the full expected path: the root and its trust status, any subordinate or issuing CAs, and the end-entity certificate.
Confirm that the certificate is in the store the application uses.
For a certificate that needs a private key, use PowerShell to confirm HasPrivateKey:
```
Get-ChildItem -Path Cert:\CurrentUser\My |
    Select-Object Subject, Thumbprint, NotAfter, HasPrivateKey
```
Replace Cert:\CurrentUser\My with Cert:\LocalMachine\My when you validate a local-computer certificate. HasPrivateKey confirms a private-key association only; it doesn't prove that the application's runtime identity can use the key.
Test private-key use and chain-policy and revocation behavior as the relying application's runtime identity. An enrollment success message or certificate-store entry doesn't validate application configuration.

Security considerations

Use the narrowest template enrollment group that meets the business requirement.
Treat caller-supplied subject and subject alternative name values as sensitive. For templates that permit requester-supplied values, restrict eligible enrollees and require appropriate approval or authorized signatures.
Verify the expected EKU and certificate chain before you bind a certificate to an application.
Don't export a private key as part of routine enrollment validation. If a backup or migration requires a Personal Information Exchange (PFX) file, follow Export a certificate with its private key.

Troubleshoot Certificates MMC enrollment

Symptom	Check
The expected template isn't listed.	Confirm that an enterprise CA publishes the template and ask the template administrator to verify the requester's applicable Read and Enroll permissions.
The wizard asks for more information.	The template requires request properties. Provide only policy-approved values, or cancel the request and ask the template owner to confirm the required identity data.
The request stays pending, or the CA denies it.	Contact the CA administrator for the request disposition. This article doesn't use Certification Authority Web Enrollment status pages.
The certificate is in the wrong store.	Verify whether the application uses the current-user, local-computer, or service-account store. For a service store, use the Certificates snap-in's Service account option, follow the service's installation requirements, and verify that the service runtime account can use the private key.
The new certificate has no private key.	Confirm that you enrolled in the intended scope and that the selected template and application require a private key.

Feedback

Was this page helpful?

Last updated on 2026-10-02