Using CertUtil MergePfx with password as a parameter

Question

I'm trying to script generation of a single pfx certificate, from one key and one pem file. The following command in Powershell will generate a .pfx as expected:

CertUtil -MergePFX $srcPemPath $outPfxPath

But it prompts me to manually enter the private key password. It'd be most convenient if I didnt have to do this manually.

Looking at the Microsoft documentation I should be able to provide the password as an optional extended property parameter, however when I try the following:

CertUtil -MergePFX $srcPemPath $outPfxPath -p $certPassword

I get an error:

Expected no more than 3 args, received 4
CertUtil: Too many arguments

Neither the usage hint or the documentation makes it clear how this is supposed to be done. Is it possible, and how?

Update

This seems to be purely an issue with my comprehension of certutil.exe's usage: '-p password' is an option, and options should be the first arguments to the certutil executable. For example, -f and -v are also options for force overwrite and verbose output respectively.

Given current working directory only contains fullchain1.pem and fullchain1.key:

In powershell: certutil -f -v -mergepfx .\fullchain1.pem .\testout.pfx

The above creates testout.pfx, overwriting any existing file, verbosely writing the algorithm and public key, prompting the user for a password

In powershell: certutil -p "pass1" -mergepfx .\fullchain1.pem .\testout.pfx

The above creates testout.pfx (provided it doesnt already exist) but will still prompt the user for a password

In powershell: certutil -p "pass1,pass2" -mergepfx .\fullchain1.pem .\testout.pfx The above creates testout.pfx, without prompting the user for a password, the private key password for testout.pfx will be pass2. pass1 and pass2 were arbitrary, pass1 appears to serve no purpose.

So I have a solution, but it'd still be nice to understand why :)

Answer 1

Any external command that has switches, may not be fully understood by PowerShell (consolehost or the ISE or VSCode console), since PowerShell has no idea what those are and would error out or ignore them, thus not passing them.

PowerShell cannot interpret what this is, and thus send it all as is and thus certutil says the error presented because that is not what is expected.

If you want to see what a command is doing, you can use two cmdlets:

1. Invoke-ScriptAnalyzer
2. Trace-Command

PowerShell as a command prefernce:

about_Command_Precedence

If you do not specify a path, PowerShell uses the following precedence order when it runs commands for all items loaded in the current session:

1. Alias
2. Function
3. Cmdlet
4. External executable files (programs and non-PowerShell scripts)

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_command_precedence?view=powershell-7

External command, executables must be properly called, including all needed quoating for parameters from the PowerShell consolehost or ISE or VSCode.

• PowerShell: Running Executables

https://social.technet.microsoft.com/wiki/contents/articles/7703.powershell-running-executables.aspx

1. Direct - Using the environment path or local folder
2. Invoke-Expression (IEX)
3. Invoke-Command (ICM)
4. Invoke-Item (II)
5. The Call Operator &
6. cmd /c - Using the old cmd shell
7. Start-Process (start/saps)
8. [Diagnostics.Process] Start()
9. WMI Win32_Process Create() Method
10. Stop-Parsing Symbol --%

So, try using, one of the below as per the above pointer:

$CMD = 'SuperApp.exe'
$arg1 = 'filename1'
$arg2 = '-someswitch'
$arg3 = 'C:\documents and settings\user\desktop\some other file.txt'
$arg4 = '-yetanotherswitch'
 
& $CMD $arg1 $arg2 $arg3 $arg4

or ...

$AllArgs = @('filename1', '-someswitch', 'C:\documents and settings\user\desktop\some other file.txt', '-yetanotherswitch')
& 'SuperApp.exe' $AllArgs