Using powershell, how to extract the thumbprint from an SSL Certificate without installing it

certificatepowershellssl

Every example I've found on StackExchange, and other internet forums, etc all tell me how to get the thumbprint from a certificate already installed into a certificate store. Alternatively, the instructions say to install the cert, then get the thumbprint.

However, I really need to get the thumbprint from the pfx file without installing it.

Best Answer

Get an object in Powershell-3.0 and later, which can then be used with Select and other property accessors:

 Get-PfxCertificate -FilePath Certificate.pfx

Alternatively, one can use openssl from msys or cygwin. However, this is tricky since it's one of those *nix programs that spews all the useful info to stderr, which gets handled badly in powershell.

 openssl pkcs12 -info -in Certificate.pfx

Note: Both of these methods require the user to input the password. I've yet to find a fully automated way to do this without manually entering the password each time.

Related Solutions

Windows – Export installed certificate and private key from a command line remotely in Windows using something besides the certmgr.MSC tool

See Stack Overflow question Export certificate from IIS using PowerShell.

If the answer works for you, then you can run PowerShell code on remote server using PSRemoting (Enter-PSSession or Invoke-Command) or psexec.

Does anyone know how to dir the cert store like, "dir cert:\localmachine\my | Where-Object { $_.hasPrivateKey } | " AND then feed that to the certutil export with the thumbprint?

Try this, works for me:

Get-ChildItem -Path 'Cert:\localmachine\My' |
    Where-Object { $_.hasPrivateKey } |
        Foreach-Object {
            &certutil.exe @('-exportpfx', '-p', 'secret',  $_.Thumbprint, "$($_.Subject).pfx")
         }

Beware, that sometimes you wouldn't be able to use Subject as file name, due to invalid foreign-language characters in the Unicode.

Windows – Securing Remote Desktop Connections With SSL Certificate From a Trusted Certificate Authority

The best that I could find is this: https://support.microsoft.com/en-us/kb/2001849

From the article: Note: It is necessary to edit the registry directly because there is no user interface on Windows client SKUs to configure a server certificate.

Best Answer

Related Solutions

Windows – Export installed certificate and private key from a command line remotely in Windows using something besides the certmgr.MSC tool

Windows – Securing Remote Desktop Connections With SSL Certificate From a Trusted Certificate Authority

Related Question