Powershell: Deploying PFX to Personal Store of Local Machine

Quick tutorial: How add pfx to personal store of LocalMachine.

#

1. Converting pfx to base64 format
2. Add base64 in this script

$base64cert = ""
$certBytes = [System.Convert]::FromBase64String($base64Cert)
$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($certBytes)
$store = New-Object system.security.cryptography.X509Certificates.X509Store "My", "LocalMachine"
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$store.Add($cert)
$store.Close()

Explanation

#

Public and private keys are not stored in the same place. Public certificates are stored in the registry, but their associated private keys are stored in the file system.

HKEY_Current_User\Software\Microsoft\SystemCertificates contains registry settings for the current user. Those can include the BLOB (Binary Large object) and various settings for the certificate, as well as settings related to the CA certificates that support the user certificates.

HKEY_Current_User\Software\Policies\Microsoft\SystemCertificates contains the same info, but for certificates distributed via Group Policy.

HKEY_Users\User SID\Software\Microsoft\SystemCertificates contains this info for the corresponding user

HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates contains this info for the corresponding service account

HKEY_Local_Machine\Software\Microsoft\SystemCertificates contain the info for the computer account

HKEY_Local_Machine\Software\Policies\Microsoft\SystemCertificates contains the same, but for GP distributed certificates for the computer account

HKEY_Local_Machine\Software\Microsoft\EnterpriseCertificates contains info about the AD published certificates

Public keys are in the registry at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates.

I find my private keys on the disk at:

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

The PowerShell command ls Cert:\CurrentUser\My\ returns installed certificates with public keys.