WinHttpCertCfg not importing certificate

Question

I need to setup a deployment script that imports an SSL certificate that my service uses. I have tried importing with WinHttpCertCfg and with CertMgr to no avail.

Here are the command-line arguments I have tried to use with both:

winhttpcertcfg.exe -i <certname>.pfx -c LOCAL_MACHINE\My -p <password> -a <user service runs as>

and

CertMgr.exe -add -all -s -r localMachine -c <cert name> My

It seems from what I have investigated that CertMgr does not allow you to import certificates with a password, so I'd rather get winhttpcertcfg working.

When I run them I get the following output: WinHttpCertCfg:

Microsoft (R) WinHTTP Certificate Configuration Tool
Copyright (C) Microsoft Corporation 2001.

CertMgr:

CertMgr Succeeded

However, when I look into the local machine certificates in MMC, try to load them from my service, or list it out through winhttpcertcfg, or even looking at the registry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates it is not found.

I have tried all of the following:

• If I install the cert manually (Through CertMgr.msc dialogs) it works.
• The user installing is running as administrator
• The user installing has full access on the certificate
• The tools print out an error when something is wrong (wrong password)
• Tried it in multiple machines (All of them server 2008 R2)

At this point I am officially out of ideas.

Thank you.

Answer 1

There's always CertUtil.exe:

CertUtil -p Password -ImportPFX File.pfx

For more options, look here:
http://technet.microsoft.com/en-us/library/cc732443.aspx

Or try:

CertUtil -ImportPFX -?

Answer 2

I found the answer:

It turns out that there are issues with the library backend that winhttpcertcfg uses to install the certificate and Win 2008. There is an alternative, and it is to install the certificates using Powershell. You can write a script to use the x509Certificate2 .NET class and import the certificate to whichever store you want. This method also gives you more flexibility to do any extra checks you need.

More details here.