Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to setup a deployment script that imports an SSL certificate that my service uses. I have tried importing with WinHttpCertCfg and with CertMgr to no avail.

Here are the command-line arguments I have tried to use with both:

winhttpcertcfg.exe -i <certname>.pfx -c LOCAL_MACHINE\My -p <password> -a <user service runs as>


CertMgr.exe -add -all -s -r localMachine -c <cert name> My

It seems from what I have investigated that CertMgr does not allow you to import certificates with a password, so I'd rather get winhttpcertcfg working.

When I run them I get the following output: WinHttpCertCfg:

Microsoft (R) WinHTTP Certificate Configuration Tool
Copyright (C) Microsoft Corporation 2001.


CertMgr Succeeded

However, when I look into the local machine certificates in MMC, try to load them from my service, or list it out through winhttpcertcfg, or even looking at the registry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates it is not found.

I have tried all of the following:

  • If I install the cert manually (Through CertMgr.msc dialogs) it works.
  • The user installing is running as administrator
  • The user installing has full access on the certificate
  • The tools print out an error when something is wrong (wrong password)
  • Tried it in multiple machines (All of them server 2008 R2)

At this point I am officially out of ideas.

Thank you.

share|improve this question
up vote 0 down vote accepted

I found the answer:

It turns out that there are issues with the library backend that winhttpcertcfg uses to install the certificate and Win 2008. There is an alternative, and it is to install the certificates using Powershell. You can write a script to use the x509Certificate2 .NET class and import the certificate to whichever store you want. This method also gives you more flexibility to do any extra checks you need.

More details here.

share|improve this answer

There's always CertUtil.exe:

CertUtil -p Password -ImportPFX File.pfx

For more options, look here:

Or try:

CertUtil -ImportPFX -?
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.