Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a collection of certificates in a p7b file, and I would like to automatically import each certificate into the correct store depending on the certificate template. What is the best way to do this with a script?

I tried using certutil -addstore root Certificate.p7b, and that will correctly place all of the root CAs into the root store, but it returns an error if it encounters any other type of certificate.

I'm willing to use batch scripts, vbscript or powershell to accomplish this task. Thanks!

share|improve this question
    
I'm assuming the GUI is too cumbersome? –  John Homer Apr 6 '12 at 18:06

2 Answers 2

I use CertMgr.exe and a simple bat file to import certs.

certmgr.exe -add -c ca.cer -s -r localMachine root  >> log.txt
certmgr.exe -add -c test.cer -s -r localMachine root  >> log.txt
certmgr.exe -add -c edu.cer -s -r localMachine root  >> log.txt

Here is a TechNet article which documents what commands/usage you can do with certmgr.exe

share|improve this answer

I haven't found a script to import it into the certificate into the correct store based on it's template. I think you have made that script yourself because It simply doesn't exist. What I did found is a PowerShell script which import certificates from a directory and in the command you have to specify the correct store yourself. I thought It might be useful for you:

How to use the script Function to import security certificates.

NOTE: To get a list of available store names, run the following command: dir cert: | Select -Expand StoreNames

Example Usages: Import-Certificate -CertFile "VeriSign_Expires-2028.08.01.cer" -StoreNames AuthRoot, Root -LocalMachine

Import-Certificate -CertFile "VeriSign_Expires-2018.05.18.p12" -StoreNames AuthRoot -LocalMachine -CurrentUser -CertPassword Password -Verbose

dir -Path C:\Certs -Filter *.cer | Import-Certificate -CertFile $_ -StoreNames AuthRoot, Root -LocalMachine -Verbose

Script itself:

#requires -Version 2.0

function Import-Certificate
{
    param
    (
        [IO.FileInfo] $CertFile = $(throw "Paramerter -CertFile [System.IO.FileInfo] is required."),
        [string[]] $StoreNames = $(throw "Paramerter -StoreNames [System.String] is required."),
        [switch] $LocalMachine,
        [switch] $CurrentUser,
        [string] $CertPassword,
        [switch] $Verbose
    )

    begin
    {
        [void][System.Reflection.Assembly]::LoadWithPartialName("System.Security")
    }

    process 
    {
        if ($Verbose)
        {
            $VerbosePreference = 'Continue'
        }

        if (-not $LocalMachine -and -not $CurrentUser)
        {
            Write-Warning "One or both of the following parameters are required: '-LocalMachine' '-CurrentUser'. Skipping certificate '$CertFile'."
        }

        try
        {
            if ($_)
            {
                $certfile = $_
            }
            $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 $certfile,$CertPassword
        }
        catch
        {
            Write-Error ("Error importing '$certfile': $_ .") -ErrorAction:Continue
        }

        if ($cert -and $LocalMachine)
        {
            $StoreScope = "LocalMachine"
            $StoreNames | ForEach-Object {
                $StoreName = $_
                if (Test-Path "cert:\$StoreScope\$StoreName")
                {
                    try
                    {
                        $store = New-Object System.Security.Cryptography.X509Certificates.X509Store $StoreName, $StoreScope
                        $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
                        $store.Add($cert)
                        $store.Close()
                        Write-Verbose "Successfully added '$certfile' to 'cert:\$StoreScope\$StoreName'."
                    }
                    catch
                    {
                        Write-Error ("Error adding '$certfile' to 'cert:\$StoreScope\$StoreName': $_ .") -ErrorAction:Continue
                    }
                }
                else
                {
                    Write-Warning "Certificate store '$StoreName' does not exist. Skipping..."
                }
            }
        }

        if ($cert -and $CurrentUser)
        {
            $StoreScope = "CurrentUser"
            $StoreNames | ForEach-Object {
                $StoreName = $_
                if (Test-Path "cert:\$StoreScope\$StoreName")
                {
                    try
                    {
                        $store = New-Object System.Security.Cryptography.X509Certificates.X509Store $StoreName, $StoreScope
                        $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
                        $store.Add($cert)
                        $store.Close()
                        Write-Verbose "Successfully added '$certfile' to 'cert:\$StoreScope\$StoreName'."
                    }
                    catch
                    {
                        Write-Error ("Error adding '$certfile' to 'cert:\$StoreScope\$StoreName': $_ .") -ErrorAction:Continue
                    }
                }
                else
                {
                    Write-Warning "Certificate store '$StoreName' does not exist. Skipping..."
                }
            }
        }
    }

    end
    { }
}

Source: Import-Certificate

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.