Microsoft Edge: Auto-select Client Certificate (Windows 11)

These instructions configure Edge to silently auto-select a client certificate for a specific website using registry-based user policies.

Caution: Please note that it involves working with the Registry Editor: the Windows Registry controls low-level system and application behavior, and incorrect changes can break apps, user profiles, or even prevent Windows from starting. Registry edits take effect immediately and bypass most safety checks, so a single typo or misplaced key can have system-wide consequences that are difficult to reverse without backups.

Step 1 — Verify the certificate location (important)

1. Press Win + R

2. Type:

   certmgr.msc
   

3. Navigate to:

   Certificates – Current User
   → Personal
   → Certificates
   

4. Confirm your client certificate is visible and has:

   • ✔ A private key

   • ✔ Intended purpose: Client Authentication

These instructions assume the cert is per-user, not machine-wide.

Step 2 — Open Registry Editor

1. Press Win + R

2. Type:

   regedit
   

3. Press Enter

Step 3 — Create the Edge policy path (User scope)

Navigate to:

HKEY_CURRENT_USER
└── SOFTWARE
    └── Policies
        └── Microsoft
            └── Edge

If any of these keys do not exist, create them:

• Right-click → New → Key

• Name exactly as shown

Step 4 — Create the AutoSelectCertificateForUrls key

Under the Edge key:

1. Right-click Edge

2. Choose New → Key

3. Name it exactly:

   AutoSelectCertificateForUrls
   

Final path should be:

HKCU\SOFTWARE\Policies\Microsoft\Edge\AutoSelectCertificateForUrls

Step 5 — Add the certificate selection rule

Inside the AutoSelectCertificateForUrls key:

1. Right-click → New → String Value

2. Name it:

   1
   

3. Double-click 1 and set Value data to one single line: ("cityscape-suite.com" for US, ".cityscape-suite.ca" for CA) 

   {"pattern":"https://[*.]cityscape-suite.com","filter":{"ISSUER":{"CN":"CityScape Internal CA"}}}

4. Update the ISSUER CN value within Value data to be the CN value found in your installed certificate (replace CityScape Internal CA):
   • ca.responder.apxconsult.com

⚠ Notes:

• Do not wrap this in []

• Do not escape quotes

• Do not add extra whitespace

• One rule = one numbered value (1, 2, 3, …)

Step 6 — Restart Edge completely

Close all Edge windows, then ensure it’s fully terminated:

taskkill /IM msedge.exe /F

Reopen Microsoft Edge.

Step 7 — Verify the policy loaded

In Edge, navigate to:

edge://policy

You should see:

AutoSelectCertificateForUrls
{"pattern":"https://smartmap.cityscape-suite.com","filter":{"ISSUER":{"CN":"CN Entered in Step 5"}}}

✔ If you see this, the policy is active
❌ If it says “No value set”, the rule is in the wrong place or malformed

Step 8 — Test

Go to:

https://smartmap.cityscape-suite.com

Expected behavior:

• ✅ No certificate picker

• ✅ Client certificate auto-selected

• ✅ Site loads normally