Install certificate with PowerShell on remote server

Question

I want to install a certificate (X.509) created with makecert.exe on a remote server. I am not able to use psexec or something like that but have to use PowerShell.

Answer 1

Scenario: ServerA has the SSL cert, ServerB would like the SSL cert imported

1. define two variables (ServerB only):

   $afMachineName = "SomeMachineNameOrIp"
   $certSaveLocation = "c:\temp\Cert.CER"
   

2. enable trust on both machines (ServerA & ServerB):

   Function enableRemotePS() {
       Enable-PSRemoting -Force
       Set-Item wsman:\localhost\client\trustedhosts $afMachineName -Force
       Restart-Service WinRM
   }
   

3. Save the certificate (ServerB only):

   Function saveCert([string]$machineName,[string]$certSaveLocation) {
       Invoke-Command -ComputerName $machineName -ArgumentList $certSaveLocation -ScriptBlock {
           param($certSaveLocation)
           $cert = dir Cert:\LocalMachine\Root | where {$_.Subject -eq "CN=YOURCERTNAME" };
           $certBytes = $cert.Export("cert");
           [system.IO.file]::WriteAllBytes($certSaveLocation, $certBytes);
       }
   
       Copy-Item -Path \\$machineName\c$\temp\CertAF.CER -Destination $certSaveLocation
   }
   

4. Import the certificate (ServerB only)

   Function importCert([string]$certSaveLocation) {
       $CertToImport = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 $certSaveLocation
   
       $CertStoreScope = "LocalMachine"
       $CertStoreName = "Root"
       $CertStore = New-Object System.Security.Cryptography.X509Certificates.X509Store $CertStoreName, $CertStoreScope
   
       # Import The Targeted Certificate Into The Specified Cert Store Name Of The Specified Cert Store Scope
       $CertStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
       $CertStore.Add($CertToImport)
       $CertStore.Close()
   }
   

Answer 2

To import a PFX file you can use Import-PfxCertificate, for example

Import-PfxCertificate -FilePath YOUR_PFX_FILE.pfx -Password (ConvertTo-SecureString -String "THE_PFX_PASSWORD" -AsPlainText -Force)

To do this on a remote computer, you can use Invoke-Command -ComputerName (and use an UNC path for the PFX file).