(Node.js) Import a PFX/P12 into the Windows Certificate Stores

Demonstrates how to import the certificates contained in a .pfx/.p12 to the Windows certificate stores.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOSX, and ARM

var os = require('os');
if (os.platform() == 'win32') {  
    if (os.arch() == 'ia32') {
        var chilkat = require('@chilkat/ck-node21-win-ia32');
    } else {
        var chilkat = require('@chilkat/ck-node21-win64'); 
    }
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node21-arm');
    } else if (os.arch() == 'x86') {
        var chilkat = require('@chilkat/ck-node21-linux32');
    } else {
        var chilkat = require('@chilkat/ck-node21-linux64');
    }
} else if (os.platform() == 'darwin') {
    if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node21-mac-m1');
    } else {
        var chilkat = require('@chilkat/ck-node21-macosx');
    }
}

function chilkatExample() {

    var primaryCert = new chilkat.Cert();

    // Load a PFX file into a certificate object.
    // The cert object will contain the certificate from the PFX that has a private key.
    // The certs in the chain of authentication (if contained in the PFX) are also loaded,
    // and can be accessed by getting the certificate chain (see below).
    // If the PFX did not include the issuer certs in the chain of authentication, then Chilkat will
    // automatically try to construct the issuer chain from the CA and intermedicate CA certs
    // already installed on the Windows system.
    var pfxPassword = "myPfxPassword";
    var success = primaryCert.LoadPfxFile("qa_data/pfx/somePfx.p12",pfxPassword);
    if (success == false) {
        console.log(primaryCert.LastErrorText);
        return;
    }

    // certChain: CertChain
    var certChain = primaryCert.GetCertChain();
    if (primaryCert.LastMethodSuccess == false) {
        console.log(primaryCert.LastErrorText);
        return;
    }

    // If the certificate chain reaches the root CA cert, then the last cert in the chain
    // is the root CA cert.
    var chainReachesRoot = certChain.ReachesRoot;
    if (chainReachesRoot == true) {
        console.log("The certificate chain reaches the root CA cert.");
    }

    // cert: Cert
    var cert;
    var i = 0;
    var numCerts = certChain.NumCerts;
    while (i < numCerts) {
        cert = certChain.GetCert(i);
        console.log("SubjectDN " + i + ": " + cert.SubjectDN);
        console.log("IssuerDN " + i + ": " + cert.IssuerDN);
        console.log("--");

        i = i+1;
    }

    // The primary cert having the private key will be imported into the Current User "My" certificate store.
    // Any intermediate root certificates will be imported into certificate store for intermediate certificate authorities.
    // The root CA cert will be imported into the Root CA cert store.

    // Let's open each of these 3 certificate stores..
    var certStoreCU = new chilkat.CertStore();
    var certStoreCA = new chilkat.CertStore();
    var certStoreRootCA = new chilkat.CertStore();
    var readOnlyFlag = false;

    // "CurrentUser" and "My" are the exact keywords to select your user account's certificate store.
    success = certStoreCU.OpenWindowsStore("CurrentUser","My",readOnlyFlag);
    if (success == false) {
        console.log("Failed to open the CurrentUser/My certificate store for read/write.");

        return;
    }

    // Certificate store for intermediate certification authorities (CAs). 
    success = certStoreCA.OpenWindowsStore("CurrentUser","CertificationAuthority",readOnlyFlag);
    if (success == false) {
        console.log("Failed to open the CurrentUser/CertificationAuthority certificate store for read/write.");

        return;
    }

    // Certificate store for trusted root certification authorities (CAs). 
    success = certStoreRootCA.OpenWindowsStore("CurrentUser","Root",readOnlyFlag);
    if (success == false) {
        console.log("Failed to open the CurrentUser/Root certificate store for read/write.");

        return;
    }

    // Iterate over the certs in the chain and import each into the desired certificate store.
    var allSuccess = true;
    i = 0;
    while (i < numCerts) {
        cert = certChain.GetCert(i);
        if (i == 0) {
            // Import the primary certificate into the CurrentUser/My certificate store.
            success = certStoreCU.AddCertificate(cert);
            if (success == false) {
                console.log(certStoreCU.LastErrorText);
                allSuccess = false;
            }

        }
        else {
            if ((i == (numCerts - 1)) && (chainReachesRoot == true)) {
                // Add the root CA certificate to the CurrentUser/Root certificate store.
                // (Your application can obviously choose whether this should be done or not.  Perhaps you prompt the user.)

                // Note: If the root CA cert is already present in the Windows certificate store, Windows will display
                // a dialog to ask if it should be deleted.  Chilkat does not explicitly display dialogs.
                success = certStoreRootCA.AddCertificate(cert);
                if (success == false) {
                    console.log(certStoreRootCA.LastErrorText);
                    allSuccess = false;
                }

            }
            else {
                // This is an intermediate CA certificate.
                success = certStoreCA.AddCertificate(cert);
                if (success == false) {
                    console.log(certStoreCA.LastErrorText);
                    allSuccess = false;
                }

            }

        }

        if (success == false) {
            console.log("Failed to import certificate.");
        }

        i = i+1;
    }

    console.log("allSuccess = " + allSuccess);

}

chilkatExample();