I've got a certificate that I need to import on a number of systems, and I'm trying to set high strong key protection on that certificate, so that when it is used, the user has to enter a password. I've found this certutil command:

certutil -f -user -p <certPwd> -importPFX .\<certName>.pfx Protect

There are two problems with this:

  1. This sets the security to medium by default. I can select High, and then it asks me to set a password, but I need it to be High by default
  2. I need to pass the password via a command, with no UI displayed on the screen. I don't want to have to manually set the password on every system, so am looking to do this via GPO or SCCM, although I'm open to other methods if needed.

I cannot find any way to set this strictly via command line, either through certutil or PowerShell. I'm hoping someone might know more than I? Can anyone assist?


The purpose of strong key protection is to require user interaction so the user explicitly confirms key operations and no operations can be scripted/automated without user explicit approval. Here is the point. Thus, strong key protection and key access automation are mutually exclusive.

  • I'm looking to automate the import of the cert (and setting the password to be used). I want the user to have to input the password to use the cert. I'm only looking to automate setting the password initially. – DarkMoon Aug 28 '17 at 11:39
  • Like I said, strong private key protection is intended against automation or any key activity behind user. – Crypt32 Aug 28 '17 at 12:27
  • Yep, I've been getting that feeling from the documentation, but thought I'd throw it out there in case I was missing something. I'll leave it open a little longer in case someone else knows a way, but then I'll accept this answer. – DarkMoon Aug 28 '17 at 20:37

I use importpfx.exe command. You can find it here: http://home.fnal.gov/~jklemenc/importpfx.html

Then I apply to all users tanks to a logon script:

[path]\importpfx.exe -f [path]\MyPFXCertificate.pfx -p [CertificatePassword] -t USER -s MY
  • Despite of the importpfx.exe age, it still works fine with Win7/8/8.1/10 32/64. – MaCae Sep 6 '17 at 11:53
  • I'm not seeing where this enables a password prompt on each use, or where that password is specified? – DarkMoon Sep 7 '17 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.