Home / server / Questions / 107028
In Process
Jesse Weigert
Asked: 2010-01-28 16:39:31 +0800 CST

Import a bunch of certificates into the correct certificate store using a script

  • 772

I have a collection of certificates in a p7b file, and I would like to automatically import each certificate into the correct store depending on the certificate template. What is the best way to do this with a script?

I tried using certutil -addstore root Certificate.p7b, and that will correctly place all of the root CAs into the root store, but it returns an error if it encounters any other type of certificate.

I'm willing to use batch scripts, vbscript or powershell to accomplish this task. Thanks!

windows ssl certificate

2 Answers

  1. I use CertMgr.exe and a simple bat file to import certs. 

    certmgr.exe -add -c ca.cer -s -r localMachine root  >> log.txt
certmgr.exe -add -c test.cer -s -r localMachine root  >> log.txt
certmgr.exe -add -c edu.cer -s -r localMachine root  >> log.txt

    Here is a TechNet article which documents what commands/usage you can do with certmgr.exe

    • 2

  2. I haven't found a script to import it into the certificate into the correct store based on it's template. I think you have made that script yourself because It simply doesn't exist. What I did found is a PowerShell script which import certificates from a directory and in the command you have to specify the correct store yourself. I thought It might be useful for you:

    How to use the script Function to import security certificates.

    NOTE: To get a list of available store names, run the following command: dir cert: | Select -Expand StoreNames

    Example Usages: Import-Certificate -CertFile "VeriSign_Expires-2028.08.01.cer" -StoreNames AuthRoot, Root -LocalMachine

    Import-Certificate -CertFile "VeriSign_Expires-2018.05.18.p12" -StoreNames AuthRoot -LocalMachine -CurrentUser -CertPassword Password -Verbose

    dir -Path C:\Certs -Filter *.cer | Import-Certificate -CertFile $_ -StoreNames AuthRoot, Root -LocalMachine -Verbose

    Script itself:

    #requires -Version 2.0

function Import-Certificate
{
    param
    (
        [IO.FileInfo] $CertFile = $(throw "Paramerter -CertFile [System.IO.FileInfo] is required."),
        [string[]] $StoreNames = $(throw "Paramerter -StoreNames [System.String] is required."),
        [switch] $LocalMachine,
        [switch] $CurrentUser,
        [string] $CertPassword,
        [switch] $Verbose
    )

    begin
    {
        [void][System.Reflection.Assembly]::LoadWithPartialName("System.Security")
    }

    process 
    {
        if ($Verbose)
        {
            $VerbosePreference = 'Continue'
        }

        if (-not $LocalMachine -and -not $CurrentUser)
        {
            Write-Warning "One or both of the following parameters are required: '-LocalMachine' '-CurrentUser'. Skipping certificate '$CertFile'."
        }

        try
        {
            if ($_)
            {
                $certfile = $_
            }
            $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 $certfile,$CertPassword
        }
        catch
        {
            Write-Error ("Error importing '$certfile': $_ .") -ErrorAction:Continue
        }

        if ($cert -and $LocalMachine)
        {
            $StoreScope = "LocalMachine"
            $StoreNames | ForEach-Object {
                $StoreName = $_
                if (Test-Path "cert:\$StoreScope\$StoreName")
                {
                    try
                    {
                        $store = New-Object System.Security.Cryptography.X509Certificates.X509Store $StoreName, $StoreScope
                        $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
                        $store.Add($cert)
                        $store.Close()
                        Write-Verbose "Successfully added '$certfile' to 'cert:\$StoreScope\$StoreName'."
                    }
                    catch
                    {
                        Write-Error ("Error adding '$certfile' to 'cert:\$StoreScope\$StoreName': $_ .") -ErrorAction:Continue
                    }
                }
                else
                {
                    Write-Warning "Certificate store '$StoreName' does not exist. Skipping..."
                }
            }
        }

        if ($cert -and $CurrentUser)
        {
            $StoreScope = "CurrentUser"
            $StoreNames | ForEach-Object {
                $StoreName = $_
                if (Test-Path "cert:\$StoreScope\$StoreName")
                {
                    try
                    {
                        $store = New-Object System.Security.Cryptography.X509Certificates.X509Store $StoreName, $StoreScope
                        $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
                        $store.Add($cert)
                        $store.Close()
                        Write-Verbose "Successfully added '$certfile' to 'cert:\$StoreScope\$StoreName'."
                    }
                    catch
                    {
                        Write-Error ("Error adding '$certfile' to 'cert:\$StoreScope\$StoreName': $_ .") -ErrorAction:Continue
                    }
                }
                else
                {
                    Write-Warning "Certificate store '$StoreName' does not exist. Skipping..."
                }
            }
        }
    }

    end
    { }
}

    Source: Import-Certificate

    • 0