# win_certificate_store – Manages the certificate store

New in version 2.5.

- Synopsis

- Parameters

- Notes

- Examples

- Return Values

- Status

## Synopsis

- Used to import/export and remove certificates and keys from the local certificate store.

- This module is not used to create certificates and will only manage existing certs as a file or in the store.

- It can be used to import PEM, DER, P7B, PKCS12 (PFX) certificates and export PEM, DER and PKCS12 certificates.

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---

file_type
string

Choices:
- der ←
- pem
- pkcs12

The file type to export the certificate as when `state=exported`.
`der` is a binary ASN.1 encoded file.
`pem` is a base64 encoded file of a der file in the OpenSSL form.
`pkcs12` (also known as pfx) is a binary container that contains both the certificate and private key unlike the other options.
When `pkcs12` is set and the private key is not exportable or accessible by the current user, it will throw an exception.

key_exportable
boolean

Choices:
- no
- yes ←

Whether to allow the private key to be exported.
If `no`, then this module and other process will only be able to export the certificate and the private key cannot be exported.
Used when `state=present` only.

key_storage
string

Choices:
- default ←
- machine
- user

Specifies where Windows will store the private key when it is imported.
When set to `default`, the default option as set by Windows is used, typically `user`.
When set to `machine`, the key is stored in a path accessible by various users.
When set to `user`, the key is stored in a path only accessible by the current user.
Used when `state=present` only and cannot be changed once imported.
See https://msdn.microsoft.com/en-us/library/system.security.cryptography.x509certificates.x509keystorageflags.aspx for more details.

password string |  | The password of the pkcs12 certificate key. This is used when reading a pkcs12 certificate file or the password to set when `state=exported` and `file_type=pkcs12`. If the pkcs12 file has no password set or no password should be set on the exported file, do not set this option.
path path |  | The path to a certificate file. This is required when state is `present` or `exported`. When state is `absent` and thumbprint is not specified, the thumbprint is derived from the certificate at this path.

state
string

Choices:
- absent
- exported
- present ←

If `present`, will ensure that the certificate at path is imported into the certificate store specified.
If `absent`, will ensure that the certificate specified by thumbprint or the thumbprint of the cert at path is removed from the store specified.
If `exported`, will ensure the file at path is a certificate specified by thumbprint.
When exporting a certificate, if path is a directory then the module will fail, otherwise the file will be replaced if needed.

store_location
-

Choices:
- CurrentUser
- LocalMachine ←

The store location to use when importing a certificate or searching for a certificate.

store_name
string

Choices:
- AddressBook
- AuthRoot
- CertificateAuthority
- Disallowed
- My ←
- Root
- TrustedPeople
- TrustedPublisher

The store name to use when importing a certificate or searching for a certificate.
`AddressBook`: The X.509 certificate store for other users
`AuthRoot`: The X.509 certificate store for third-party certificate authorities (CAs)
`CertificateAuthority`: The X.509 certificate store for intermediate certificate authorities (CAs)
`Disallowed`: The X.509 certificate store for revoked certificates
`My`: The X.509 certificate store for personal certificates
`Root`: The X.509 certificate store for trusted root certificate authorities (CAs)
`TrustedPeople`: The X.509 certificate store for directly trusted people and resources
`TrustedPublisher`: The X.509 certificate store for directly trusted publishers

thumbprint string |  | The thumbprint as a hex string to either export or remove. See the examples for how to specify the thumbprint.

## Notes

Note

- Some actions on PKCS12 certificates and keys may fail with the error `the specified network password is not correct`, either use CredSSP or Kerberos with credential delegation, or use `become` to bypass these restrictions.

- The certificates must be located on the Windows host to be set with path.

- When importing a certificate for usage in IIS, it is generally required to use the `machine` key_storage option, as both `default` and `user` will make the private key unreadable to IIS APPPOOL identities and prevent binding the certificate to the https endpoint.

## Examples

    - name: Import a certificate
      win_certificate_store:
        path: C:\Temp\cert.pem
        state: present

    - name: Import pfx certificate that is password protected
      win_certificate_store:
        path: C:\Temp\cert.pfx
        state: present
        password: VeryStrongPasswordHere!
      become: yes
      become_method: runas

    - name: Import pfx certificate without password and set private key as un-exportable
      win_certificate_store:
        path: C:\Temp\cert.pfx
        state: present
        key_exportable: no
      # usually you don't set this here but it is for illustrative purposes
      vars:
        ansible_winrm_transport: credssp

    - name: Remove a certificate based on file thumbprint
      win_certificate_store:
        path: C:\Temp\cert.pem
        state: absent

    - name: Remove a certificate based on thumbprint
      win_certificate_store:
        thumbprint: BD7AF104CF1872BDB518D95C9534EA941665FD27
        state: absent

    - name: Remove certificate based on thumbprint is CurrentUser/TrustedPublishers store
      win_certificate_store:
        thumbprint: BD7AF104CF1872BDB518D95C9534EA941665FD27
        state: absent
        store_location: CurrentUser
        store_name: TrustedPublisher

    - name: Export certificate as der encoded file
      win_certificate_store:
        path: C:\Temp\cert.cer
        state: exported
        file_type: der

    - name: Export certificate and key as pfx encoded file
      win_certificate_store:
        path: C:\Temp\cert.pfx
        state: exported
        file_type: pkcs12
        password: AnotherStrongPass!
      become: yes
      become_method: runas
      become_user: SYSTEM

    - name: Import certificate be used by IIS
      win_certificate_store:
        path: C:\Temp\cert.pfx
        file_type: pkcs12
        password: StrongPassword!
        store_location: LocalMachine
        key_storage: machine
        state: present

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
thumbprints list | success | A list of certificate thumbprints that were touched by the module. Sample: ['BC05633694E675449136679A658281F17A191087']

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]

- This module is maintained by the Ansible Community. [community]

### Authors

- Jordan Borean (@jborean93)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.