I wrote a PS script where in it will import the certificate to the existing site to the IIS server, but i want a script where in it will match the thumbprint of the Cert which i am having with the thumbprint of the cert in the local machine store, if the thumbprint matches then import that certificate to the store, if not dont import the cert.

Example I have a pfx file with thumbprint = XXXXXX and the script need to be check if there are any thumbprint as same as above in my machine or in any remote server then the Cert which i am having need to be replaced or imported to the location.


#Clearing the Console host in PS

$certPath = 'C:\TEMP\Sample.pfx'
$CertificatePassword = 'XXXXXX'
$SiteName = "SampleTest"
$HostName = "Sitebinding.com"
$SiteFolder = Join-Path -Path 'C:\inetpub\wwwroot' -ChildPath $SiteName

Write-Host 'Import pfx certificate' $certPath
$certRootStore = “LocalMachine”
$certStore = "My"
$pfx = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store($certStore,$certRootStore) 
$certThumbprint = $pfx.Thumbprint

#Write-Host 'Add website' $SiteName
#New-WebSite -Name $SiteName -PhysicalPath $SiteFolder -Force
#$IISSite = "IIS:\Sites\$SiteName"
#Set-ItemProperty $IISSite -name  Bindings -value @{protocol="https";bindingInformation="*:443:$HostName"}
#if($applicationPool) { Set-ItemProperty $IISSite -name  ApplicationPool -value $applicationPool}

Write-Host 'Bind certificate with Thumbprint' $certThumbprint
#$obj = get-webconfiguration "//sites/site[@name='$SiteName']"
$obj = Get-WebBinding $SiteName -Port 443
#$binding = $obj.bindings.Collection[0]
#$method = $binding.Methods["AddSslCertificate"]
$method = $obj.Methods["AddSslCertificate"]
$methodInstance = $method.CreateInstance()
$methodInstance.Input.SetAttributeValue("certificateHash", $certThumbprint)
$methodInstance.Input.SetAttributeValue("certificateStoreName", $certStore)

Thanks In Advance.

To get a list of certificates on your local machine's personal store:

$localcerts = Get-ChildItem Cert:\LocalMachine\My

To get the certificate object of a pfx (mine had a password):

$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new("C:\temp\mypfx.pfx","mypassword", [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::MachineKeySet)

To compare the thumbprints:

if ($localcerts.Thumbprint -contains $cert.Thumbprint) { <# do stuff #> }

If you want to search the other stores on your local PC like trusted publishers, recurse through the root:

$localcerts = Get-ChildItem cert:\LocalMachine -recurse
$localcerts.thumbprint  # Returns 130+ certificates on my machine

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.