To remove a certificate in Windows 11, press Windows + R, type certmgr.msc, and press Enter to open the certificate manager for your account (use certlm.msc for certificates installed for the whole computer). Expand the store that holds the certificate, such as Personal > Certificates, right-click the certificate, choose Delete, and click Yes. Only delete certificates you recognize and no longer need; removing built-in root certificates can break websites, apps, and Windows Update.
This guide covers where Windows stores certificates, how to find the right one, how to delete it with the certificate manager, PowerShell, or certutil, how to back it up first, and how to remove certificates used by browsers, VPNs, and Wi-Fi.
Before you start
- Back up the certificate in case you need it again: right-click it, choose All Tasks > Export, and follow the wizard. Include the private key if it’s offered and you may reinstall it.
- Identify it carefully using Issued To, Issued By, Expiration Date, and Intended Purposes. Double-click to see details and the thumbprint.
- Don’t remove Microsoft or major certificate authority root certificates unless you know why. Windows may also reinstall trusted roots automatically.
- You need administrator rights for computer-wide certificates.
Where Windows stores certificates
| Store | What’s in it |
|---|---|
| Personal | Your own certificates, often with private keys (email, VPN, client authentication) |
| Trusted Root Certification Authorities | Root certificates Windows trusts to verify websites and software |
| Intermediate Certification Authorities | Certificates that link sites and software to trusted roots |
| Trusted Publishers | Software publishers you’ve chosen to trust |
| Untrusted Certificates | Certificates Windows explicitly distrusts |
Method 1: Remove a certificate with the certificate manager
- Press Windows + R, type certmgr.msc (your account) or certlm.msc (local computer), and press Enter. Click Yes if prompted.
- Expand the store, such as Personal, and click Certificates.
- Right-click the certificate and choose Delete.
- Click Yes to confirm. For root certificates, Windows shows an extra warning.
To find a certificate quickly, click the top node (for example, Certificates – Current User), then Action > Find Certificates.
Method 2: Remove a certificate with PowerShell
- Open Terminal (Admin) for computer certificates, or a normal PowerShell window for your own.
- List certificates and their thumbprints:
Get-ChildItem Cert:\CurrentUser\My | Format-List Subject, Issuer, Thumbprint, NotAfter(useCert:\LocalMachine\Myfor the computer store, orRootinstead ofMyfor trusted roots). - Delete one by thumbprint:
Remove-Item Cert:\CurrentUser\My\THUMBPRINT, replacing THUMBPRINT with the value you noted. - To also remove its private key, add
-DeleteKey.
Method 3: Remove a certificate with certutil
In an administrator Command Prompt:
certutil -delstore My "THUMBPRINT"
certutil -user -delstore My "THUMBPRINT"The first command works on the computer’s Personal store, and the second on your account’s. Replace My with Root or CA for other stores.
Remove certificates used by specific apps
- Chrome and Edge – they use the Windows certificate store. In the browser, go to Settings > Privacy and security > Security > Manage certificates to jump to the same certificates.
- Firefox – it has its own store: Settings > Privacy & Security > Certificates > View Certificates, select one, and click Delete or Distrust.
- VPN and Wi-Fi – remove the VPN connection or forget the Wi-Fi network in Settings > Network & internet first, then delete its certificate from Personal or Trusted Root.
- Work or school certificates – certificates pushed by device management come back automatically. Disconnect the work account in Settings > Accounts > Access work or school, or ask IT.
Remove expired certificates
Expired certificates are harmless in most cases, but you can clean them up. In PowerShell: Get-ChildItem Cert:\CurrentUser\My | Where-Object NotAfter -lt (Get-Date) lists them; review the list before removing anything.
Troubleshooting
- Delete is grayed out or access denied – open the tool as administrator, and check whether the certificate is managed by policy.
- The certificate came back – Windows Update, an app, or your organization reinstalled it. Remove the app or policy that installs it.
- Websites broke after deleting a root – import the backup you exported, or run Windows Update to restore trusted roots.
Frequently asked questions
Is it safe to delete certificates?
It’s safe for certificates you added yourself or that belong to apps you’ve removed. Deleting system root certificates can cause errors, so leave those alone unless you’re sure.
How do I remove a suspicious root certificate?
Check who issued it and which app installed it. Adware and some inspection tools add their own roots; uninstall the app first, then delete the certificate and run a malware scan.
Does this work on Windows 10?
Yes. The tools and commands are the same on Windows 10.
Kermit Matthews is a freelance writer based in Philadelphia, Pennsylvania with more than a decade of experience writing technology guides. He has a Bachelor’s and Master’s degree in Computer Science and has spent much of his professional career in IT management.
He specializes in writing content about iPhones, Android devices, Microsoft Office, and many other popular applications and devices.