I am still learning the ways of powershell, and am having difficulties solving a problem.

I would like to have the following logic flow:

  1. Go out to \fileserver\certs and pull all thumbprints for each .cer file there
  2. Run the list of remote thumbprints against local cert:\location list of thumbprints
  3. If a .cer is not installed locally based on a missing thumbprint, install the .cer from the \fileserver\certs to the cert:\location

There is a little more logic in the middle, but overall that is what I seek to accomplish. My primary problem is pulling the thumbprint from the remote .cer files, or determining if they are installed locally in a different fashion (to my knowledge the thumbprint is the most logical way, but I am totally open to suggestions).

I could just install every cert in the directory every time my script is ran, but I fear unnecessary overhead, and the show stopper is that it would require admin rights each time it is ran, rather than on first launch or detection of new certs.

The primary problem is that I am unable to gather the thumbprint from the .cer file, and Google suggestions are fruitless thus far. If I can figure out how to pull the thumbprint from the remote .cer, I am fairly certain I could figure out the foreach logic necessary from that point.

My current code:

#Add certificate to local trusted store
$certCheckLocation = "Cert:\LocalMachine\Root\(Cert Thumbprint...)"
$certPutLocation = "Cert:\LocalMachine\Root\"
$certFile = (Get-ChildItem -Path \\server\file.cer)
$certCheckFile = (Test-Path -Path $certCheckLocation)

if ($certCheckFile -eq $false) {

        If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
            $messageBox.Popup("Please run as an admin.",5,"Proxy Utility",0)
        } else {
            $certFile | Import-Certificate -CertStoreLocation $certPutLocation

Below this is GUI code and some stuff that changes the proxy setting, etc.

In short, it takes a single cer and applies it to the local machine. If the user is not admin, it prompts them to restart the script as admin. I intend to scale this out in a foreach fashion so that when a cer is added to a particular network directory, the script will notice on launch and attempt to install the new cert. If user is not admin, it prompts ONLY when it needs to install a new cert.

Still learning powershell, so any assistance would be greatly appreciated!


The easiest way to pull a thumbprint from a .cer file would be to create an certificate object in powershell and import the cert in that. After which you can have powershell display the object including the thumbprint.

Something like this:

$cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.