Why there is a repository "Computer \ Personal \ Certificates", as well as "Current user \ Personal \ Certificates",

Question

I am comparing certificates on my local computer, and MMC.exe allows me to view the certificates for Current User and Computer.

I do not understand why there would be two "personal" stores. Can someone explain why there are two of them, and how they interact?

It would be nice to know why these other folders are there too. The only one that seems to have a fixed value is Trusted Root Certificates. Another constant is that Fiddler also seems to put its certificates in "Current User \ Personal"

For instance; FedUtil will only use certificates located at the following location (web.config)

        <serviceCertificate findValue="6CB9aaaaa636EBF52980152CDCB02D3BBBBBBBBB" storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" />

Answer 1

This is basically a question of what their intended scope is. The Local Machine Personal repository contains certificates that are used by either applications as client / server certificates and belong only to this computer; whereas the "Current User Personal" store contains certificates that are not tied to any particular machine (for example, you may have a certificate that you use to digitally sign documents on several different machines).

Answer 2

- ... . , (, , - ..).

, , , , , . (, , ) CurrentUser, (, SSL -) LocalMachine.

Answer 3

, , CA .

, VPN, ( , VPN), ( , VPN - , , ). Computer\Personal Current User\Personal.

VPN - ( , CA ), , ( CA).

, , VPN, ( VPN ), -, , , VPN , - .

To answer how they interact, certificates in the computer \ personal location are applied to all users who access the machine, while the current user \ personal applies only to the current user (the view is obvious, but this is a difference, as I understand it). In my example, certificates work together to provide authentication outside the domain for the machine and user.