6

I want to import a pfx using cmd. I am using certutils for that. But I am getting a prompt asking to trust the certificate. I want to automatize import so I want to skip the warning prompt. How can I accomplish that?

Warning Prompt

I am using command certutil -f -user -p PASSWORD -importpfx c:\cert.pfx

Amol Manthalkar
  • 1,890
  • 2
  • 16
  • 16
  • I do not use certutil. But thie following article may give you some pointers http://blogs.msdn.com/b/steverac/archive/2009/07/09/adding-certificates-to-the-local-certificates-store-and-setting-local-policy-using-a-command-line-system-center-updates-publisher-example.aspx – Raj Oct 29 '14 at 10:10
  • check this answer as well, http://stackoverflow.com/questions/5171117/import-pfx-file-into-particular-certificate-store-from-command-line – Raj Oct 29 '14 at 10:13

1 Answers1

13

The reason you got a prompt dialog is that you are trying to add a "CA certificate" into the "Trusted Root Certification Authorities" store. In fact, when you use "certutil -f -user -p PASSWORD -importpfx c:\cert.pfx" to import a PFX certificate, two actions happen:

  1. Add a personal certificate(which includes the private key) into the "Personal" store.
  2. Add a CA certificate into the "Trusted Root Certification Authorities" store.

It is the second action that cause the UAC to prompt a warning dialog, since you are trying to add one CA　certificate into the "Trusted Root Certification Authorities" store and this means that any web host that holds this certicate will be trusted in the future, this is a very important action and should be treated very discreetly by the user, shouldn't it? So the UAC will warn the user to comfirm this action.

There is only one way to suppress the warning dialog, that is "you don't add the CA certificate into the "Trusted Root Certification Authorities" store by doing so:

 certutil -f -user -p PASSWORD -importpfx c:\cert.pfx NoRoot

Add personal certificate into "Personal" store will not prompt any warning dialog. However, by this way, the web host that holds the CA certificate will not be trusted any more and this can be very frustrating if you use HTTPS to access the web host.

iericzhou
  • 620
  • 8
  • 11
  • 2
    `"The reason you got a prompt dialog is that you are trying to add a "CA certificate" into the "Trusted Root Certification Authorities" store"`. It's inconsistent though. The same command As Administrator to the Computer store doesn't prompt, meaning the user interaction is more intrusive when done on a User level, discouraging its use (and thus encouraging using the Computer store -- something more dangerous -- instead). – tresf Sep 21 '19 at 14:45
  • I think that adding `-silent` also won't hurt, but indeed it doesn't work when `NoRoot` is needed. – Mikhail Orlov Oct 08 '20 at 11:42
  • Are you sure that this is correct? my certutil doesn't have these options – Hola Soy Edu Feliz Navidad Dec 09 '22 at 14:46