What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Python can read certificates directly from the Windows certificate stores, and the cryptography package can parse and verify X.509 certificates. Changing what is stored in Windows, however, is a separate job that belongs to Windows tools, not to Python’s standard library. Keeping those three jobs apart resolves most of the confusion around native certificate handling on Windows.
The title’s “MSP” is not a standard term in this context. This guide treats the problem as getting at Windows-managed certificates from Python: enumerating them, parsing the X.509 material, and checking whether a server’s certificate chains to a trusted root.
As an Amazon Associate I earn from qualifying purchases.
Three different jobs, three different tools
Most failed attempts come from asking one tool to do all three jobs. The table below separates them.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems| Task | Tool | Platform | Changes the store? |
|---|---|---|---|
| Enumerate certificates in a Windows system store | ssl.enum_certificates() in the Python standard library |
Windows only, per the Python 3.13 ssl documentation; added in Python 3.4 |
No |
| Parse and verify X.509 certificates | cryptography (third-party package, installed separately) |
Python code using the package; the verification API is documented as unstable | No |
| Create, import, delete, or change store contents and trust | MMC Certificates snap-in or PowerShell’s Cert: provider |
Windows administration | Yes |
Microsoft’s Learn article “Managing Certificates with Certificate Stores” puts the stakes plainly: “The certificate store is central to all certificate functionality.” Before you write any code, decide which of the three jobs you are doing.
#1 Best Overall
Start with store scope
Windows groups certificates into logical system stores such as MY, Root, Trust, and CA. A logical store can aggregate several physical stores, so the same name does not always describe one place. Scope matters more than the name, and a certificate’s visibility depends on which identity owns the store.
| Scope | What it holds | Who it affects |
|---|---|---|
| Current User | Certificates for the signed-in user account | That user’s processes; not automatically visible to services |
| Local Computer | Machine-wide certificates and trusted roots | Every user and service on the machine |
| Service account | Certificates for the account a specific service runs under | That service only |
Microsoft’s administration guide distinguishes these three scopes. A certificate you can see in your own session is not proof that a service running under another account can use it.
Read certificates with ssl.enum_certificates()
The standard library’s ssl.enum_certificates(store_name) accepts the Windows system store names CA, ROOT, and MY, using the spelling in Python’s documentation. Each entry is a tuple of three values:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- the certificate as bytes;
- the encoding, either
x509_asnorpkcs_7_asn; - the trust information, which is either a set of purpose OIDs or
True.
This function enumerates. It does not add, remove, or edit entries, and it is not a substitute for the full set of Windows CryptoAPI store operations. The related ssl.enum_crls() function lists certificate revocation lists in the same way.
A working read example
The following script lists the usable X.509 entries in the ROOT store that are trusted for server authentication. The purpose OID 1.3.6.1.5.5.7.3.1 is the standard identifier for server authentication.
import ssl
from cryptography import x509
SERVER_AUTH = "1.3.6.1.5.5.7.3.1"
def load_trusted_roots(store_name="ROOT"):
roots = []
for der, encoding, trust in ssl.enum_certificates(store_name):
if encoding != "x509_asn":
continue # PKCS #7 entries are skipped in this example
if trust is not True and SERVER_AUTH not in trust:
continue
try:
roots.append(x509.load_der_x509_certificate(der))
except ValueError:
continue # malformed entry; log it rather than failing silently
return roots
roots = load_trusted_roots("ROOT")
print(len(roots), "server-auth roots found")The trust is not True check matters. A value of True means the entry is not restricted to particular purposes, so it must not be dropped.
What the read tells you, and what it does not
A certificate appearing in the ROOT list means the local machine holds it in that scope. It does not mean any given application trusts it, because many applications keep their own trust configuration. Compare the Python result with what the target application actually uses.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Parse X.509 material with cryptography
The cryptography project implements X.509 in accordance with RFC 5280 and focuses principally on WebPKI use cases. For this task it does the parsing that the standard library does not.
Rank #3
Three parsing functions cover most needs: x509.load_der_x509_certificate() for DER bytes such as those returned by ssl.enum_certificates(), x509.load_pem_x509_certificate() for a single PEM certificate, and x509.load_pem_x509_certificates() for a PEM file containing several certificates, such as a leaf followed by intermediates.
Windows shows a certificate’s thumbprint, which is the SHA-1 hash of the DER encoding. You can compute the same value to match entries across tools:
from cryptography import x509
from cryptography.hazmat.primitives import hashes
def windows_thumbprint(der_bytes):
cert = x509.load_der_x509_certificate(der_bytes)
return cert.fingerprint(hashes.SHA1()).hex().upper()Use this when you need to confirm that the certificate you are testing is the same object you inspected in MMC or PowerShell.
Verify a server certificate
Verification is a separate step from parsing. The documented cryptography workflow builds a Store from trusted certificates, creates a server verifier for a DNSName, and then checks a leaf certificate against that verifier with any untrusted intermediates.
from cryptography import x509
from cryptography.x509 import DNSName
from cryptography.x509.verification import PolicyBuilder, Store
trusted = Store(roots) # roots from load_trusted_roots() above
certs = x509.load_pem_x509_certificates(chain_pem) # bytes read from the server
leaf, intermediates = certs[0], certs[1:]
verifier = (
PolicyBuilder()
.store(trusted)
.build_server_verifier(DNSName("www.example.com"))
)
verifier.verify(leaf, intermediates) # raises on failureThree cautions apply to this example:
- The
Storecontains only what you pass to it. It does not read the Windows trust configuration, so a bundle you assemble by hand is not automatically equivalent to what Windows applications trust. - The verification API is marked unstable in the
cryptographydocumentation and is not covered by the project’s backwards-compatibility policy. Pin the package version in production and recheck the current docs before upgrading. - Treat revocation as a separate check unless your policy explicitly covers it. Confirm the current documentation for what the verifier checks.
Validate the way a Windows host validates
For a server certificate on Windows, Microsoft’s guidance is to check four things together: the DNS identity, the SSL policy, the chain, and the revocation result. PowerShell’s Test-Certificate cmdlet can run that check against the machine’s own chain:
$cert = Get-ChildItem Cert:LocalMachineMy |
Where-Object { $_.Subject -like "*www.example.com*" } |
Select-Object -First 1
Test-Certificate -Cert $cert -Policy SSL -DNSName "www.example.com"A True result is scoped to the policy and chain context you supplied. It does not show that your application uses the same trust configuration, and it does not replace a live connection test against the real service.
Making changes safely
Changing the Local Computer trusted-root store changes system trust and can affect applications across the machine. Before any change:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Confirm the scope (Local Computer or Current User) and the store name.
- Confirm the certificate’s subject, purpose, and thumbprint against the source you trust.
- Record the current contents of the store so you can reverse the change.
- Identify which applications depend on that trust and plan a test of each.
Troubleshooting
The certificate is visible in Python but a service cannot use it
Check the store scope first. A certificate in a Current User store is not available to a service running under another account. Move or reissue the certificate into the scope the service actually uses, then retest.
Best Value
Verification fails with a missing-issuer error
Confirm that the server sends its intermediates and that you pass them as intermediates. Then confirm that the root appears in your trusted list with the server-authentication purpose. A root that is present but restricted to other purposes will not validate a TLS server.
Python accepts the certificate but the application rejects it
The application probably uses a different trust source, such as its own CA bundle or a separate store. Python’s result does not carry over to that application. Test the application against the live endpoint and compare its trust configuration with the store you inspected.
enum_certificates is unavailable on Linux or macOS
This behavior is expected. The Python documentation describes the function as Windows-only. On other platforms, load the trust anchors from a file you manage and feed them into the same cryptography verification code.
Quick Recap
Checklist before you rely on the result
- The store scope and owning identity are known.
- The task is classified as read, parse, verify, or modify.
- The trust roots used by your code match the roots the application uses.
- The DNS name, SSL policy, chain, and revocation result all pass.
- A live connection to the real service succeeds.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
