6

I have a collection of certificates in a p7b file, and I would like to automatically import each certificate into the correct store depending on the certificate template. What is the best way to do this with a script?

I tried using certutil -addstore root Certificate.p7b, and that will correctly place all of the root CAs into the root store, but it returns an error if it encounters any other type of certificate.

I'm willing to use batch scripts, vbscript or powershell to accomplish this task. Thanks!

1
  • I'm assuming the GUI is too cumbersome?
    – John Homer
    Apr 6, 2012 at 18:06

2 Answers 2

2

I use CertMgr.exe and a simple bat file to import certs.

certmgr.exe -add -c ca.cer -s -r localMachine root  >> log.txt
certmgr.exe -add -c test.cer -s -r localMachine root  >> log.txt
certmgr.exe -add -c edu.cer -s -r localMachine root  >> log.txt

Here is a TechNet article which documents what commands/usage you can do with certmgr.exe

0

I haven't found a script to import it into the certificate into the correct store based on it's template. I think you have made that script yourself because It simply doesn't exist. What I did found is a PowerShell script which import certificates from a directory and in the command you have to specify the correct store yourself. I thought It might be useful for you:

How to use the script Function to import security certificates.

NOTE: To get a list of available store names, run the following command: dir cert: | Select -Expand StoreNames

Example Usages: Import-Certificate -CertFile "VeriSign_Expires-2028.08.01.cer" -StoreNames AuthRoot, Root -LocalMachine

Import-Certificate -CertFile "VeriSign_Expires-2018.05.18.p12" -StoreNames AuthRoot -LocalMachine -CurrentUser -CertPassword Password -Verbose

dir -Path C:\Certs -Filter *.cer | Import-Certificate -CertFile $_ -StoreNames AuthRoot, Root -LocalMachine -Verbose

Script itself:

#requires -Version 2.0

function Import-Certificate
{
    param
    (
        [IO.FileInfo] $CertFile = $(throw "Paramerter -CertFile [System.IO.FileInfo] is required."),
        [string[]] $StoreNames = $(throw "Paramerter -StoreNames [System.String] is required."),
        [switch] $LocalMachine,
        [switch] $CurrentUser,
        [string] $CertPassword,
        [switch] $Verbose
    )

    begin
    {
        [void][System.Reflection.Assembly]::LoadWithPartialName("System.Security")
    }

    process 
    {
        if ($Verbose)
        {
            $VerbosePreference = 'Continue'
        }

        if (-not $LocalMachine -and -not $CurrentUser)
        {
            Write-Warning "One or both of the following parameters are required: '-LocalMachine' '-CurrentUser'. Skipping certificate '$CertFile'."
        }

        try
        {
            if ($_)
            {
                $certfile = $_
            }
            $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 $certfile,$CertPassword
        }
        catch
        {
            Write-Error ("Error importing '$certfile': $_ .") -ErrorAction:Continue
        }

        if ($cert -and $LocalMachine)
        {
            $StoreScope = "LocalMachine"
            $StoreNames | ForEach-Object {
                $StoreName = $_
                if (Test-Path "cert:\$StoreScope\$StoreName")
                {
                    try
                    {
                        $store = New-Object System.Security.Cryptography.X509Certificates.X509Store $StoreName, $StoreScope
                        $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
                        $store.Add($cert)
                        $store.Close()
                        Write-Verbose "Successfully added '$certfile' to 'cert:\$StoreScope\$StoreName'."
                    }
                    catch
                    {
                        Write-Error ("Error adding '$certfile' to 'cert:\$StoreScope\$StoreName': $_ .") -ErrorAction:Continue
                    }
                }
                else
                {
                    Write-Warning "Certificate store '$StoreName' does not exist. Skipping..."
                }
            }
        }

        if ($cert -and $CurrentUser)
        {
            $StoreScope = "CurrentUser"
            $StoreNames | ForEach-Object {
                $StoreName = $_
                if (Test-Path "cert:\$StoreScope\$StoreName")
                {
                    try
                    {
                        $store = New-Object System.Security.Cryptography.X509Certificates.X509Store $StoreName, $StoreScope
                        $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
                        $store.Add($cert)
                        $store.Close()
                        Write-Verbose "Successfully added '$certfile' to 'cert:\$StoreScope\$StoreName'."
                    }
                    catch
                    {
                        Write-Error ("Error adding '$certfile' to 'cert:\$StoreScope\$StoreName': $_ .") -ErrorAction:Continue
                    }
                }
                else
                {
                    Write-Warning "Certificate store '$StoreName' does not exist. Skipping..."
                }
            }
        }
    }

    end
    { }
}

Source: Import-Certificate

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .