title: Does anybody know how the powershell certificate provider paths map to certmgr.msc folders?
body: <p>When using powershell to investigate the <a href="https://technet.microsoft.com/en-us/library/hh847807.aspx" rel="noreferrer">Certificate Provider</a> i noticed that all the paths seem <em>similar</em> but not the same as the folder structure within <a href="https://msdn.microsoft.com/en-us/library/e78byta0%28v=vs.110%29.aspx" rel="noreferrer">certmgr</a>.  It seems pretty clear that:</p>
  
  <pre><code>Certs:\LocalMachine ~= Certificates (Local Computer)
  Certs:\CurrentUser ~= Certificates - Current User
  </code></pre>
  
  <p>I'm also guessing that:</p>
  
  <pre><code>Root ~= Trusted Root Certification Authority
  My ~= Personal
  WebHosting ~= WebHosting
  ...
  </code></pre>
  
  <p>But i have been unable to find any sort of official reference (or even sensible explanation) to give me the <a href="https://en.wiktionary.org/wiki/warm_fuzzy" rel="noreferrer">warm fuzzy</a> I'm looking for...</p>
  
  <p>My intent is to test an https WCF service locally (both server and client side).  I can easily generate the self signed certificate needed by the server using <a href="https://technet.microsoft.com/en-us/library/hh848633.aspx" rel="noreferrer">New-SelfSignedCertificate</a>.  However, if I try to point my client (also .NET) at the service it fails to connect given that the service serves up a non-trusted certificate.  </p>
  
  <p>I have found various <em>out-dated</em> references (like <a href="http://www.codeproject.com/Articles/24027/SSL-with-Self-hosted-WCF-Service" rel="noreferrer">this one</a>), showing how I could use a combination of <a href="https://msdn.microsoft.com/library/windows/desktop/aa386968.aspx" rel="noreferrer">makecert</a> (now deprecated), and certmgr to generate a certificate authority, then use it to sign the cert for my https service, then install the certificate authority cert into <em>Trusted Root Certification Authority</em> container to get everything working.  While this approach would likely work, it is certainly not developer/automation friendly.</p>
  
  <p>That said, I was able to use powershell to do this:</p>
  
  <pre><code>$my_cert_store_location = "Cert:\LocalMachine\My"
  $root_cert_store_location = "Cert:\LocalMachine\Root"
  $root_friendly_name = "Test Root Authority"
  $root_cert_subject = "CN=$($root_friendly_name)"
  # The ip and port you want to reserve for your app
  $ipport = "127.0.0.11:8734"
  # Your app guid (found in ApplicationInfo.cs)
  $appid = "{f77c65bd-d592-4a7b-ae32-cab24130fdf6}"
  # Your dns name
  $dns_name = "my-machine-local"
  $rebuild_root_cert = $false
  
  $root_cert = Get-ChildItem $my_cert_store_location | 
      Where-Object {$_.SubjectName.Name.Equals($root_cert_subject)}
  if ($root_cert -and $rebuild_root_cert) 
  {
      Get-ChildItem $root_cert_store_location |
          Where-Object {$_.SubjectName.Name.Equals($root_cert_subject)} |
          Remove-Item
  
      Remove-Item $root_cert
      $root_cert = $false
  }
  if (-not $root_cert) 
  {
      $root_cert = New-SelfSignedCertificate `
          -Type Custom `
          -FriendlyName $root_friendly_name `
          -HashAlgorithm sha384 `
          -KeyAlgorithm RSA `
          -KeyLength 4096 `
          -Subject $root_cert_subject `
          -KeyUsage DigitalSignature, CertSign `
          -NotAfter (Get-Date).AddYears(20) `
          -CertStoreLocation $my_cert_store_location
      Write-Output "Created root cert: $($root_cert.Thumbprint)"
  
      $exported_cert = New-TemporaryFile
      Export-Certificate -Cert $root_cert -FilePath $exported_cert.FullName
      $imported_root_cert = Import-Certificate -FilePath $exported_cert.FullName `
          -CertStoreLocation $root_cert_store_location
      Write-Output "Imported root cert to: $($root_cert_store_location)\$($imported_root_cert.Thumbprint)"
  }
  
  Write-Output "Root cert is: $($root_cert.Thumbprint)"
  
  $test_signed_cert_subject = "CN=$($dns_name)"
  $test_signed_cert = Get-ChildItem $my_cert_store_location | 
      Where-Object {$_.SubjectName.Name.Equals($test_signed_cert_subject)}
  if (-not $test_signed_cert)
  {
      $test_signed_cert = New-SelfSignedCertificate `
          -Type Custom `
          -Subject $test_signed_cert_subject `
          -FriendlyName $dns_name `
          -Signer $root_cert `
          -CertStoreLocation $my_cert_store_location
      Write-Output "Created signed cert: $($test_signed_cert.Thumbprint)"
  }
  
  Write-Output "Signed cert is: $($test_signed_cert.Thumbprint)"
  
  if ($test_signed_cert)
  {
      netsh http delete sslcert `
          ipport="$($ipport)"
      netsh http add sslcert `
          ipport="$($ipport)" `
          appid="$($appid)" `
          certstorename="My" `
          certhash="$($test_signed_cert.Thumbprint)"
      Write-Output "Assigned signed cert to: $($ipport)"
  }
  </code></pre>
  
  <p>But the question still stands...  Is there any information about how the certificate provider paths map to certmgr folders?</p>