The Windows OS maintains a certificate store that holds trusted CA root certificates in the Windows registry. The certificate store is organized into physical stores that are scoped to different levels:
  • Local machine store—Contains certificates that apply to all users and services on the computer. Only administrators can modify this store.
  • Current user store—Contains certificates specific to the logged-in user. Each user can modify their own current user store.

Within each physical store, Windows organizes certificates into logical stores. The relevant store for TLS trust validation is Trusted Root Certification Authorities, which contains the root CA certificates that Windows trusts.

From OpenEdge 13.1 onwards, all OpenEdge TLS client components use the local machine store by default for PKI certificate chain validation. No configuration is required to enable this setting.

Import user certificates on Windows

To import user certificates:
  1. Search for Manage computer certificates in the Windows Search box for computer certificates.

    The certlm utility opens.

  2. Create or select the folder where you want to store your CA root certificates.
  3. Right-click the folder to select All Tasks > Import.
  4. Locate and import your certificate.

    When clients connect to the application server using HTTPS, the trust store is automatically checked for a valid CA root certificate.