(Chilkat2-Python) Import a PFX/P12 into the Windows Certificate Stores

Demonstrates how to import the certificates contained in a .pfx/.p12 to the Windows certificate stores.

Chilkat2 Python Downloads install with pip pip3 install chilkat2 or download... Python Module for Windows, Linux, Alpine Linux, MacOS, Solaris

import sys
import chilkat2

primaryCert = chilkat2.Cert()

# Load a PFX file into a certificate object.
# The cert object will contain the certificate from the PFX that has a private key.
# The certs in the chain of authentication (if contained in the PFX) are also loaded,
# and can be accessed by getting the certificate chain (see below).
# If the PFX did not include the issuer certs in the chain of authentication, then Chilkat will
# automatically try to construct the issuer chain from the CA and intermedicate CA certs
# already installed on the Windows system.
pfxPassword = "myPfxPassword"
success = primaryCert.LoadPfxFile("qa_data/pfx/somePfx.p12",pfxPassword)
if (success == False):
    print(primaryCert.LastErrorText)
    sys.exit()

# certChain is a CkCertChain
certChain = primaryCert.GetCertChain()
if (primaryCert.LastMethodSuccess == False):
    print(primaryCert.LastErrorText)
    sys.exit()

# If the certificate chain reaches the root CA cert, then the last cert in the chain
# is the root CA cert.
chainReachesRoot = certChain.ReachesRoot
if (chainReachesRoot == True):
    print("The certificate chain reaches the root CA cert.")

i = 0
numCerts = certChain.NumCerts
while i < numCerts :
    # cert is a CkCert
    cert = certChain.GetCert(i)
    print("SubjectDN " + str(i) + ": " + cert.SubjectDN)
    print("IssuerDN " + str(i) + ": " + cert.IssuerDN)
    print("--")

    i = i + 1

# The primary cert having the private key will be imported into the Current User "My" certificate store.
# Any intermediate root certificates will be imported into certificate store for intermediate certificate authorities.
# The root CA cert will be imported into the Root CA cert store.

# Let's open each of these 3 certificate stores..
certStoreCU = chilkat2.CertStore()
certStoreCA = chilkat2.CertStore()
certStoreRootCA = chilkat2.CertStore()
readOnlyFlag = False

# "CurrentUser" and "My" are the exact keywords to select your user account's certificate store.
success = certStoreCU.OpenWindowsStore("CurrentUser","My",readOnlyFlag)
if (success == False):
    print("Failed to open the CurrentUser/My certificate store for read/write.")

    sys.exit()

# Certificate store for intermediate certification authorities (CAs). 
success = certStoreCA.OpenWindowsStore("CurrentUser","CertificationAuthority",readOnlyFlag)
if (success == False):
    print("Failed to open the CurrentUser/CertificationAuthority certificate store for read/write.")

    sys.exit()

# Certificate store for trusted root certification authorities (CAs). 
success = certStoreRootCA.OpenWindowsStore("CurrentUser","Root",readOnlyFlag)
if (success == False):
    print("Failed to open the CurrentUser/Root certificate store for read/write.")

    sys.exit()

# Iterate over the certs in the chain and import each into the desired certificate store.
allSuccess = True
i = 0
while i < numCerts :
    # cert is a CkCert
    cert = certChain.GetCert(i)
    if (i == 0):
        # Import the primary certificate into the CurrentUser/My certificate store.
        success = certStoreCU.AddCertificate(cert)
        if (success == False):
            print(certStoreCU.LastErrorText)
            allSuccess = False

    else:
        if ((i == (numCerts - 1)) and (chainReachesRoot == True)):
            # Add the root CA certificate to the CurrentUser/Root certificate store.
            # (Your application can obviously choose whether this should be done or not.  Perhaps you prompt the user.)

            # Note: If the root CA cert is already present in the Windows certificate store, Windows will display
            # a dialog to ask if it should be deleted.  Chilkat does not explicitly display dialogs.
            success = certStoreRootCA.AddCertificate(cert)
            if (success == False):
                print(certStoreRootCA.LastErrorText)
                allSuccess = False

        else:
            # This is an intermediate CA certificate.
            success = certStoreCA.AddCertificate(cert)
            if (success == False):
                print(certStoreCA.LastErrorText)
                allSuccess = False

    if (success == False):
        print("Failed to import certificate.")

    i = i + 1

print("allSuccess = " + str(allSuccess))