(PowerShell) Import a PFX/P12 into the Windows Certificate Stores

Demonstrates how to import the certificates contained in a .pfx/.p12 to the Windows certificate stores.

Chilkat .NET Downloads Chilkat .NET Assemblies

Add-Type -Path "C:\chilkat\ChilkatDotNet47-9.5.0-x64\ChilkatDotNet47.dll"

$primaryCert = New-Object Chilkat.Cert

# Load a PFX file into a certificate object.
# The cert object will contain the certificate from the PFX that has a private key.
# The certs in the chain of authentication (if contained in the PFX) are also loaded,
# and can be accessed by getting the certificate chain (see below).
# If the PFX did not include the issuer certs in the chain of authentication, then Chilkat will
# automatically try to construct the issuer chain from the CA and intermedicate CA certs
# already installed on the Windows system.
$pfxPassword = "myPfxPassword"
$success = $primaryCert.LoadPfxFile("qa_data/pfx/somePfx.p12",$pfxPassword)
if ($success -eq $false) {
    $($primaryCert.LastErrorText)
    exit
}

$certChain = $primaryCert.GetCertChain()
if ($primaryCert.LastMethodSuccess -eq $false) {
    $($primaryCert.LastErrorText)
    exit
}

# If the certificate chain reaches the root CA cert, then the last cert in the chain
# is the root CA cert.
$chainReachesRoot = $certChain.ReachesRoot
if ($chainReachesRoot -eq $true) {
    $("The certificate chain reaches the root CA cert.")
}

$i = 0
$numCerts = $certChain.NumCerts
while ($i -lt $numCerts) {
    $cert = $certChain.GetCert($i)
    $("SubjectDN " + $i + ": " + $cert.SubjectDN)
    $("IssuerDN " + $i + ": " + $cert.IssuerDN)
    $("--")

    $i = $i + 1
}

# The primary cert having the private key will be imported into the Current User "My" certificate store.
# Any intermediate root certificates will be imported into certificate store for intermediate certificate authorities.
# The root CA cert will be imported into the Root CA cert store.

# Let's open each of these 3 certificate stores..
$certStoreCU = New-Object Chilkat.CertStore
$certStoreCA = New-Object Chilkat.CertStore
$certStoreRootCA = New-Object Chilkat.CertStore
$readOnlyFlag = $false

# "CurrentUser" and "My" are the exact keywords to select your user account's certificate store.
$success = $certStoreCU.OpenWindowsStore("CurrentUser","My",$readOnlyFlag)
if ($success -eq $false) {
    $("Failed to open the CurrentUser/My certificate store for read/write.")

    exit
}

# Certificate store for intermediate certification authorities (CAs). 
$success = $certStoreCA.OpenWindowsStore("CurrentUser","CertificationAuthority",$readOnlyFlag)
if ($success -eq $false) {
    $("Failed to open the CurrentUser/CertificationAuthority certificate store for read/write.")

    exit
}

# Certificate store for trusted root certification authorities (CAs). 
$success = $certStoreRootCA.OpenWindowsStore("CurrentUser","Root",$readOnlyFlag)
if ($success -eq $false) {
    $("Failed to open the CurrentUser/Root certificate store for read/write.")

    exit
}

# Iterate over the certs in the chain and import each into the desired certificate store.
$allSuccess = $true
$i = 0
while ($i -lt $numCerts) {
    $cert = $certChain.GetCert($i)
    if ($i -eq 0) {
        # Import the primary certificate into the CurrentUser/My certificate store.
        $success = $certStoreCU.AddCertificate($cert)
        if ($success -eq $false) {
            $($certStoreCU.LastErrorText)
            $allSuccess = $false
        }

    }
    else {
        if (($i -eq ($numCerts - 1)) -and ($chainReachesRoot -eq $true)) {
            # Add the root CA certificate to the CurrentUser/Root certificate store.
            # (Your application can obviously choose whether this should be done or not.  Perhaps you prompt the user.)

            # Note: If the root CA cert is already present in the Windows certificate store, Windows will display
            # a dialog to ask if it should be deleted.  Chilkat does not explicitly display dialogs.
            $success = $certStoreRootCA.AddCertificate($cert)
            if ($success -eq $false) {
                $($certStoreRootCA.LastErrorText)
                $allSuccess = $false
            }

        }
        else {
            # This is an intermediate CA certificate.
            $success = $certStoreCA.AddCertificate($cert)
            if ($success -eq $false) {
                $($certStoreCA.LastErrorText)
                $allSuccess = $false
            }

        }

    }

    if ($success -eq $false) {
        $("Failed to import certificate.")
    }

    $i = $i + 1
}

$("allSuccess = " + $allSuccess)