导入 PfxCertificate 返回 FileNotFoundException

Question

I'm trying to distribute a single self-signed certificate to a number of servers, into the personal certificate store of a set of service accounts. This certificate will be used to decrypt sensitive files that only the service accounts should be able to read.

The certificate was created as follows:

New-SelfSignedCertificate -DnsName CredentialVault `
    -CertStoreLocation "Cert:\CurrentUser\My" `
    -KeyUsage KeyEncipherment,DataEncipherment -Type DocumentEncryptionCert `
    -KeyAlgorithm RSA -KeyLength 2048 

$computer = 'SERVER123.EXAMPLE.COM'
$cred = New-Object PSCredential 'MYDOMAIN\USER213', `
            $(ConvertTo-SecureString -String 'P4$$w0Rd' -AsPlainText -Force)

$scriptBlock = {
    Import-PfxCertificate -FilePath 'C:\temp\CredentialVault.pfx' `
        -Password $(ConvertTo-SecureString -String '1234' -AsPlainText -Force) `
        -CertStoreLocation "Cert:\CurrentUser\My"
}

Invoke-Command -ComputerName $computer -Credential $cred -ScriptBlock $scriptBlock 

I was executing the code on the server SERVER123.EXAMPLE.COM (but with a different account), just to see if it would work before trying remote servers. That's why the file path is referring to a local file.

However, even though the file is accessible by the MYDOMAIN\\USER213 account (I tested the Import-PfxCertificate command directly on the same server with that user first), PowerShell returns a System.IO.FileNotFoundException as you can see below.

The PFX file could not be found.
    + CategoryInfo          : NotSpecified: (:) [Import-PfxCertificate], FileNotFoundException
    + FullyQualifiedErrorId : System.IO.FileNotFoundException,Microsoft.CertificateServices.Commands.ImportPfxCertificate
    + PSComputerName        : SERVER123.EXAMPLE.COM

I have no clue what the issue is. Suggestions are more than welcome!

Version info:

• Windows Server 2016
• PowerShell 5.1.14393.3471

Answer 1

可能你必须在路径中尝试使用变量$env:HOMEDRIVE\\temp\\CredentialVault.pfx

Answer 2

I ended up solving it by copying the file to the remote system first, through a PSSession .

Still no idea why this works and the original code didn't. ¯\\_(ツ)_/¯

$certFile = 'C:\temp\CredentialVault.pfx'
$remoteFile = [System.IO.Path]::Combine('C:\Temp', [System.IO.Path]::GetFileName($certFile))
$certPassword = $(ConvertTo-SecureString -String '1234' -AsPlainText -Force)
$cred = Get-Credential

$sess = New-PSSession -ComputerName $server -Credential $cred
try {
    Copy-Item -Path $certFile -ToSession $sess -Destination $remoteFile
    Invoke-Command -Session $sess -ScriptBlock {
        Import-PfxCertificate -FilePath $remoteFile `
                              -Password $certPassword `
                              -CertStoreLocation "Cert:\CurrentUser\My"
        Remove-Item $remoteFile
    }
}
finally {
    Remove-PSSession $sess
}