On Windows 2012 R2, winhttpcertcfg -i FileName -a CertAccount -c LOCAL_MACHINE\MY -p Password installs the certificate on Trusted Root Store instead of LOCAL_MACHINE\MY. I also need to grant access to the private key to an account specified by the -a option. Is there a way to achieve the same using Powershell / CertUtil ?
Winhttpcertcfg does not import certificates correctly on Server 2008 R2 and onwards. The download page says it is compatible upto Server 2003. See
The alternative command is certutil.
What is missing is a tool that takes arguments like Winhttpcertcfg that can take a parameter to which store you want to install to. Certutil cannot do that.
See answer by jaspernygaard
Winhttpcertcfg does allow granting access to accounts which certutil does not do and it works on Server 2008 R2 to Server 2012 R2 via the -g parameter.
The only option to import a certificate and grant permissions to an account is using Powershell. See Answer by mao47 for simple import of certificate using Powershell
See answer for importing and granting access using Powershell http://stackoverflow.com/questions/20852807/setting-private-key-permissions-with-powershell
If you want to write a tool then use C#