Windows – Import Root CA into Trusted Root Certificate Store from a script

pkissl-certificatewindows

We're looking into the possibility of deploying our enterprise CA to users at their homes, and we're looking for a method to programmatically install a root CA.

I noticed certutil isn't included on the default XP install.

Does anyone know of a similar utility that can import certificates into certificate stores without prompting the user for any information?

We need to target XP, Vista, and 7.

Best Answer

Lookup CEnroll for XP, I believe it's deprecated in Vista and Windows 7 though.

This might help with the Vista/7 problem. http://msdn.microsoft.com/en-gb/library/aa374863.aspx

Related Solutions

Why is Windows 2012 R2 not trusting the self-signed certificate

The error you are receiving is not that it is not a trusted root certificate, but that it is not able to verify up the chain to a trusted certificate. If any part of the chain is broken, untrusted, or missing, you will receive such an error. The error that I get with an untrusted, self-signed root is this: This CA root certificate is not trusted. To enable trust, install this certificate in the Trusted Root Certification Authorities store. But for you, it says it cannot verify up to a trusted root certificate. This may be that during the self-signing process, you may have told openssl to sign the certificate with a different root (not self-sign), or it may not have been set as a root CA. If it's the first, you must trust the root it was signed with instead. If it's the latter, it's a matter of setting a few properties in openssl.conf.

Dovecot Certificate Authentication

The Dovecot wiki seems to have an error, or maybe the name of the ssl_username_from_cert setting has changed. On my Ubuntu host with Dovecot 2.2.9, in /etc/dovecot/conf.d/10-auth.conf, I have:

# Take the username from client's SSL certificate, using 
# X509_NAME_get_text_by_NID() which returns the subject's DN's
# CommonName. 
#auth_ssl_username_from_cert = no

So it seems that you need to replace ssl_username_from_cert by auth_ssl_username_from_cert, and the wiki needs to be corrected.

Best Answer

Related Solutions

Why is Windows 2012 R2 not trusting the self-signed certificate

Dovecot Certificate Authentication

Related Topic