Distribute User Certificates Easily and Securely with PowerShell

Windows does not offer a built-in way to distribute user certificates via Group Policy. Fortunately, this issue can be quickly and efficiently resolved with a PowerShell script. I have prepared and tested such a script that exactly fills this gap.

The script can be easily deployed on all clients through your software distribution or a Group Policy. It copies the certificates from a central network path and installs them locally in the user's certificate store. For this to work, clients need access to the network path where the certificates reside. Additionally, the script should be run with the necessary permissions to import the certificates correctly.

# This script imports all .pfx certificates from a specified folder
# into the current user's personal certificate store.
# The password for the certificates can be specified in the script.
# If no password is specified, the import will be attempted without a password.

# Path to the folder containing the .pfx certificates
$certFolder = "C:\Path\to\Certificates-Folder"  # Please adjust to your environment!

# Password for the certificates (leave empty if no password is required)
# Note: Storing passwords in plain text is insecure.
$password = "YourPasswordHere"  # Optional: enter password here or leave empty (e.g., $password = "")

# Open the current user's personal certificate store
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("My", "CurrentUser")
$store.Open("ReadWrite")

# Search for all .pfx files in the directory
$pfxFiles = Get-ChildItem -Path $certFolder -Filter "*.pfx"

foreach ($pfxFile in $pfxFiles) {
    $pfxPath = $pfxFile.FullName
    
    # Create a certificate object
    $pfxCert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
    
    try {
        if ($password) {
            # Try to import the certificate with password
            $pfxCert.Import(
                $pfxPath,
                $password,
                [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::UserKeySet -bor
                [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet
            )
            Write-Host "Certificate imported with password: $($pfxCert.Subject)"
        } else {
            # Try to import the certificate without password
            $pfxCert.Import(
                $pfxPath,
                $null,
                [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::UserKeySet -bor
                [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet
            )
            Write-Host "Certificate imported without password: $($pfxCert.Subject)"
        }
        
        # Add certificate to store
        $store.Add($pfxCert)
    } catch {
        Write-Host "Error importing ${pfxPath}: $($_.Exception.Message)"
        
        # If import with password fails, attempt without password
        if ($password) {
            try {
                $pfxCert.Import(
                    $pfxPath,
                    $null,
                    [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::UserKeySet -bor
                    [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet
                )
                $store.Add($pfxCert)
                Write-Host "Successfully imported certificate without password: $($pfxCert.Subject)"
            } catch {
                Write-Host "Error importing without password: $($_.Exception.Message)"
            }
        }
    }
}

# Close certificate store
$store.Close()

Write-Host "All certificates have been processed."

This PowerShell script automatically imports all .pfx certificates from a specified folder into the current user's personal certificate store. The password for the certificates can be specified directly in the script; if none is provided, the import will be attempted without a password.

The script opens the certificate store, searches the folder for .pfx files, and imports them using the provided password when necessary. Errors are caught and displayed to the user.