Add certificates in a standalone environment

You can add certificates as trusted or authorized certificates to run all software signed by those certificates on a protected system.

Note
Application Control supports only X.509 certificates.

Add a certificate:

sadmin cert add

Use an existing certificate or extract certificates from one or more signed files. You can extract certificate from any signed file using ScGetCerts.exe (<Install_dir>\Tools\ScGetCerts\ScGetCerts.exe).

Syntax	Description
`sadmin cert add <certificatename>`	Adds a certificate as a trusted certificate. For example: `sadmin cert add test.cer`
`sadmin cert add –c <certificatecontent>`	Use the `-c` argument to specify the certificate content as trusted. For example: sadmin cert add –c MIIFGjCCBAKgAwIBAgIQbwr3oyE8ytuorcGnG3VhpDANBgkqhkiG9w0BAQUFADCB tDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwNDEuMCwGA1UEAxMl VmVyaVNpZ24gQ2xhc3MgMyBDb2RlIFNpZ25pbmcgMjAwNCBDQTAeFw0wNTEyMTAw MDAwMDBaFw0wNjEyMTAyMzU5NTlaMIHdMQswCQYDVQQGEwJVUzETMBEGA1UECBMK Q2FsaWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2UxIzAhBgNVBAoUGkFkb2JlIFN5 c3RlbXMgSW5jb3Jwb3JhdGVkMT4wPAYDVQQLEzVEaWdpdGFsIElEIENsYXNzIDMg LSBNaWNyb3NvZnQgU29mdHdhcmUgVmFsaWRhdGlvbiB2MjEcMBoGA1UECxQTSW5m b3JtYXRpb24gU3lzdGVtczEjMCEGA1UEAxQaQWRvYmUgU3lzdGVtcyBJbmNvcnBv cmF0ZWQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJcS8Tyuz/JSB6XlyV5Z d02tIo4iZoXANFxbGVXS3Yg4v7zIR8k2K0Tzzpmz3Y00Qr237nTslDnLb4rMx9Fr +DmH1Fq2CwQBCVTnrwbtdUyv2v977Fc05B09WEJvZmvcm22iNrfpCV5wqd7OTp1F qP2HIMa0ihztWAc3R9cn8xPPAgMBAAGjggF/MIIBezAJBgNVHRMEAjAAMA4GA1Ud DwEB/wQEAwIHgDBABgNVHR8EOTA3MDWgM6Axhi9odHRwOi8vQ1NDMy0yMDA0LWNy bC52ZXJpc2lnbi5jb20vQ1NDMy0yMDA0LmNybDBEBgNVHSAEPTA7MDkGC2CGSAGG +EUBBxcDMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9y cGEwEwYDVR0lBAwwCgYIKwYBBQUHAwMwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUF BzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6 Ly9DU0MzLTIwMDQtYWlhLnZlcmlzaWduLmNvbS9DU0MzLTIwMDQtYWlhLmNlcjAf BgNVHSMEGDAWgBQI9VHo+/49PWQ2fGjPW3io37nFNzARBglghkgBhvhCAQEEBAMC BBAwFgYKKwYBBAGCNwIBGwQIMAYBAQABAf8wDQYJKoZIhvcNAQEFBQADggEBAFY7 rAYt9WjCDFQ+YNHfnEZxav3zhGhTdTwqGpWZJh/wg9IgLnyRqMnoQNjDFsSCduxf FryGREMwCHI/PvEYq7hKZsUXSGWRNl+Auuomg0OFGG1ZlBv/rWtQEbwmGKgtwXMD Dm2IYY3t7O7shG3KW4qHg+Tq04pR8VGTGJodwZWEsj9JavErsujI7SFDMkj9xFz4 VD/ilkWF+AyzSLAyUTq797y/7TsG5Y1SeMtze49cVbJVRrbGtq3kSzF56adsA4Hv v2CjM379GkYX0Atro74YLEwcfwdAogZ+F+XtOU9CR48bPvkFP5xMLUJ46HPs1u83 Jk2lrr5OYmtMqd7f0
`sadmin cert add –u <certificatename>`	Add trusted certificates as updaters using the `-u` argument. For example: `sadmin cert add –u test.cer` Caution Selecting this option makes sure that all files signed by a certificate acquire updater rights. For example, if you set the Microsoft certificate that signs the Internet Explorer application as an updater, Internet Explorer can download and execute any application from the Internet. In effect, any file added or modified by an application that is signed by the certificate is added to the allow list automatically.

Syntax

Description

sadmin cert add <certificatename>

Adds a certificate as a trusted certificate.

For example: sadmin cert add test.cer

sadmin cert add –c <certificatecontent>

Use the -c argument to specify the certificate content as trusted.

For example: sadmin cert add –c MIIFGjCCBAKgAwIBAgIQbwr3oyE8ytuorcGnG3VhpDANBgkqhkiG9w0BAQUFADCB tDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwNDEuMCwGA1UEAxMl VmVyaVNpZ24gQ2xhc3MgMyBDb2RlIFNpZ25pbmcgMjAwNCBDQTAeFw0wNTEyMTAw MDAwMDBaFw0wNjEyMTAyMzU5NTlaMIHdMQswCQYDVQQGEwJVUzETMBEGA1UECBMK Q2FsaWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2UxIzAhBgNVBAoUGkFkb2JlIFN5 c3RlbXMgSW5jb3Jwb3JhdGVkMT4wPAYDVQQLEzVEaWdpdGFsIElEIENsYXNzIDMg LSBNaWNyb3NvZnQgU29mdHdhcmUgVmFsaWRhdGlvbiB2MjEcMBoGA1UECxQTSW5m b3JtYXRpb24gU3lzdGVtczEjMCEGA1UEAxQaQWRvYmUgU3lzdGVtcyBJbmNvcnBv cmF0ZWQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJcS8Tyuz/JSB6XlyV5Z d02tIo4iZoXANFxbGVXS3Yg4v7zIR8k2K0Tzzpmz3Y00Qr237nTslDnLb4rMx9Fr +DmH1Fq2CwQBCVTnrwbtdUyv2v977Fc05B09WEJvZmvcm22iNrfpCV5wqd7OTp1F qP2HIMa0ihztWAc3R9cn8xPPAgMBAAGjggF/MIIBezAJBgNVHRMEAjAAMA4GA1Ud DwEB/wQEAwIHgDBABgNVHR8EOTA3MDWgM6Axhi9odHRwOi8vQ1NDMy0yMDA0LWNy bC52ZXJpc2lnbi5jb20vQ1NDMy0yMDA0LmNybDBEBgNVHSAEPTA7MDkGC2CGSAGG +EUBBxcDMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9y cGEwEwYDVR0lBAwwCgYIKwYBBQUHAwMwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUF BzABhhhodHRwOi8vb2NzcC52ZXJpc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6 Ly9DU0MzLTIwMDQtYWlhLnZlcmlzaWduLmNvbS9DU0MzLTIwMDQtYWlhLmNlcjAf BgNVHSMEGDAWgBQI9VHo+/49PWQ2fGjPW3io37nFNzARBglghkgBhvhCAQEEBAMC BBAwFgYKKwYBBAGCNwIBGwQIMAYBAQABAf8wDQYJKoZIhvcNAQEFBQADggEBAFY7 rAYt9WjCDFQ+YNHfnEZxav3zhGhTdTwqGpWZJh/wg9IgLnyRqMnoQNjDFsSCduxf FryGREMwCHI/PvEYq7hKZsUXSGWRNl+Auuomg0OFGG1ZlBv/rWtQEbwmGKgtwXMD Dm2IYY3t7O7shG3KW4qHg+Tq04pR8VGTGJodwZWEsj9JavErsujI7SFDMkj9xFz4 VD/ilkWF+AyzSLAyUTq797y/7TsG5Y1SeMtze49cVbJVRrbGtq3kSzF56adsA4Hv v2CjM379GkYX0Atro74YLEwcfwdAogZ+F+XtOU9CR48bPvkFP5xMLUJ46HPs1u83 Jk2lrr5OYmtMqd7f0

sadmin cert add –u <certificatename>

Add trusted certificates as updaters using the -u argument.

For example:

sadmin cert add –u test.cer

Caution
Selecting this option makes sure that all files signed by a certificate acquire updater rights. For example, if you set the Microsoft certificate that signs the Internet Explorer application as an updater, Internet Explorer can download and execute any application from the Internet. In effect, any file added or modified by an application that is signed by the certificate is added to the allow list automatically.