Windows – How to make a self-signed certificate trusted

Thanks to the link posted by harrymc, I spent almost a day investigating this problem and figured out it was Windows Server 2008 default domain policy.

I suspect this problem only applies to Windows PC in a domain network environment. The default domain policy doesn't allow user to install additional certificate to Trusted Root Certification Authorities, but the worst thing is if you tried Windows 7 will still say "Import Successfull" anyway.

If you want to check whether your domain policy allow you to install certificate to Trusted Root Certification Authority, when importing the cert via certmgr.msc manually select the store and tick 'Show physical stores'. You should be able to place the cert into Trusted Root Certification Authorities\Local Computer

If you can't see above, then it has to be enabled via group policy editor on your Windows Server Domain Controller (client PC restart is required for it to take effect):

Did you try it manually (by double-clicking on the CER file)? If even manually it's not working, you might be encountering a Vista bug.

Install a Root CA certificate from the command line (cmd.exe)

(This requires the Windows SDK. Visual Studio will install it for you and add it to the %PATH%.)

certmgr /add /c mycertificate.cer /s /r localMachine root

Note that no errors will be reported; the command will always return success (even when using a non-existing file for the certificate!). If the certificate doesn't show up in the Certificate Manager (certmgr.msc) after running this command, repeat the process using the manual steps below to check if there is any error in your certificate file.

Manual steps to install a Root CA certificate

1. Double-click on the .cer file.
2. On the Certificate dialog box, click Install Certificate to start the Certificate Import Wizard.
3. On the Welcome page, click Next.
4. On the Certificate Store page, select Place all certificates in the following store and click Browse.
5. In the Select Certificate Store dialog box, select Show Physical Stores.
6. Double-click Trusted Root Certification Authorities, select Local Computer, and then click OK.
7. On the Certificate Store page, click Next.
8. On the summary page, review the details and click Finish.

Install a Root CA certificate from PowerShell

See @harrymc's great answer below.