0

I have have tried the following ways to import a certificate to the localmachine store via PowerShell. The console was running as administrator.

Import-PfxCertificate -Exportable -Password (secure.string) -CertStoreLocation Cert:\LocalMachine\My -FilePath 'certificatepath.pfx'

I also tried

$PFXFile = certificatepath.pfxc
$PFXPassword = secure.string
$PFXObject = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2($PFXFile, $PFXPassword, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable)

$CertificateStore = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Store('My','LocalMachine')
$CertificateStore.Open('MaxAllowed')
$CertificateStore.Add($PFXObject
$CertificateStore.Close()

This issue is this, neither method works. In both instances it does show up in the LocalMachine store, but it looks like there is private key associated with it even though the PFX file does have it.

If I import this same file via the MMC console, it loads fine. Via PowerShell, the following Event Appears

Level: Error
Source: Schannel
Event Id: 36870
Message: A fatal error occurred when attempting to access the TLS server credential private key. The error code returned from the cryptographic module is 0x8009030D. The internal error state is 10001.

Additional info: If I do a Get-Item on a certificate imported via MMC, the property PrivateKey does have information listed there. Imported via PowerShell and it's not there.

The OS is Server 2019 if that matters.

1 Answer 1

1

With the second method, what happens if you set the "Exportable,MachineKeySet,PersistKeySet" import flags for $PfxObject? Just using a string for the options:

$PFXObject = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2($PFXFile,$PFXPassword,"Exportable,MachineKeySet,PersistKeySet")

If that doesn't help, maybe try the password as just a regular string too.

If it works with those import flags, perhaps delete the cert and try it again without PersistKeySet.

I've personally needed a little trial and error to determine when PersistKeySet is required. But if the option isn't needed for your process (including tested fresh on a different machine), then it's usually best to omit unnecessary parameters.

4
  • 1
    That did it. Would it be MachineKeySet or PersistKeySet that was needed to make this work?
    – Jessie
    Feb 1, 2023 at 6:06
  • Most likely MachineKeySet, As I mentioned, PersistKeySet can be a little mysterious, so I suggest trying it without that option on another system. If it still works, great, you can leave it out.
    – LeeM
    Feb 1, 2023 at 7:15
  • Without PersistKeySet, I was getting inconsistent results. Sometimes the property PrivateKey would be present, other times it wasn't. Looks like I'll be keeping that in the code.
    – Jessie
    Feb 1, 2023 at 21:32
  • That's interesting that it was inconsistent - sounds like it's definitely best to include it for your scenario. Thanks for the info!
    – LeeM
    Feb 3, 2023 at 2:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .