<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI Emoji";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Note to self…. Don’t give up <span style="font-family:"Segoe UI Emoji",sans-serif">
😊</span> I found some c++ code and adapted it.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">https://www.sysadmins.lv/retired-msft-blogs/alejacma/how-to-import-a-certificate-without-user-interaction-cpp-csharp.aspx<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is left here in case anyone else is looking to do what I was trying to.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># brief outline new code<o:p></o:p></p>
<p class="MsoNormal">cryptui = ctypes.WinDLL('CryptUI.dll')<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">def import_pfx():<o:p></o:p></p>
<p class="MsoNormal"> # Open the cert store you want to import to… in my case “local_machine\My”<br>
hMyCertStore = crypt32.CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, None, CERT_SYSTEM_STORE_LOCAL_MACHINE | CERT_STORE_MAXIMUM_ALLOWED_FLAG, "My")<o:p></o:p></p>
<p class="MsoNormal"> if not hMyCertStore:<o:p></o:p></p>
<p class="MsoNormal"> print("Error: CertOpenStore(MY) failed")<o:p></o:p></p>
<p class="MsoNormal"> return False<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> # create the necessary information for the import_src struct<o:p></o:p></p>
<p class="MsoNormal"> dwImportFlags = CRYPT_MACHINE_KEYSET | CRYPT_EXPORTABLE<o:p></o:p></p>
<p class="MsoNormal"><br>
import_src = CRYPTUI_WIZ_IMPORT_SRC_INFO()<o:p></o:p></p>
<p class="MsoNormal"> import_src.dwSize = ctypes.sizeof(CRYPTUI_WIZ_IMPORT_SRC_INFO)<o:p></o:p></p>
<p class="MsoNormal"> import_src.dwSubjectChoice = CRYPTUI_WIZ_IMPORT_SUBJECT_FILE<o:p></o:p></p>
<p class="MsoNormal"> import_src.pwszFileName = "c:\\certs\\my.pfx"<o:p></o:p></p>
<p class="MsoNormal"> import_src.pwszPassword = "supersecretpassword"<o:p></o:p></p>
<p class="MsoNormal"> import_src.dwFlags = dwImportFlags<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> # Call the CryptUIWizImport API<o:p></o:p></p>
<p class="MsoNormal"> result = cryptui.CryptUIWizImport(<o:p></o:p></p>
<p class="MsoNormal"> CRYPTUI_WIZ_NO_UI,<o:p></o:p></p>
<p class="MsoNormal"> None,<o:p></o:p></p>
<p class="MsoNormal"> None,<o:p></o:p></p>
<p class="MsoNormal"> ctypes.byref(import_src),<o:p></o:p></p>
<p class="MsoNormal"> hMyCertStore # define the cert store you want to import to<o:p></o:p></p>
<p class="MsoNormal"> )<o:p></o:p></p>
<p class="MsoNormal"> # check for errors and then return true on success<o:p></o:p></p>
<p class="MsoNormal"> return True<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="mso-ligatures:none">From:</span></b><span style="mso-ligatures:none"> Steven Manross <steven@manross.net>
<br>
<b>Sent:</b> Monday, September 23, 2024 10:24 PM<br>
<b>To:</b> Steven Manross <steven@manross.net>; python-win32@python.org<br>
<b>Subject:</b> RE: win32crypt.PFXImportCertStore()<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Although I would still like to understand what I’m doing wrong in win32crypt, this seems to get me by for now….
<span style="font-family:"Segoe UI Emoji",sans-serif">😊</span> <span style="font-family:"Segoe UI Emoji",sans-serif">
☹</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> certutil -f -p "pfxtpassword" -importpfx "c:\scripts\certs\pfxname.pfx” # imports the PFX to the local machine “Personal” certificates store<o:p></o:p></p>
<p class="MsoNormal"><br>
HTH someone else<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Steven<o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="mso-ligatures:none">From:</span></b><span style="mso-ligatures:none"> python-win32 <<a href="mailto:python-win32-bounces+steven=manross.net@python.org">python-win32-bounces+steven=manross.net@python.org</a>>
<b>On Behalf Of </b>Steven Manross<br>
<b>Sent:</b> Sunday, September 22, 2024 1:14 PM<br>
<b>To:</b> <a href="mailto:python-win32@python.org">python-win32@python.org</a><br>
<b>Subject:</b> [python-win32] win32crypt.PFXImportCertStore()<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Howdy,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am trying to import a PFX/P12 certificate to the local machine certificate store and there’s no errors, but it also doesn’t seem to work either.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve left a bit of debugging code in the script to show all the things I’ve tried, but again there’s no errors, and it generates the PyStore object like the docs say it will and I enumerate the certificates in the store with a for loop,
BUT it doesn’t seem to add the PFX to the store (or at least I can’t see it in the Certificates MMC app for the local machine).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I can manually import the PFX by using the CryptoAPI “Install PFX” option from the windows explorer shell just fine, but the win32crypt.PFXImportCertStore() call doesn’t error, but it also enumerates the machine store certs without the
“newly added” PFX.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># this is output from the script in the for loop at the bottom from the attached python script – these 2 certificates existed prior to the PFX trying to get imported<o:p></o:p></p>
<p class="MsoNormal">1 Cert: <PyCERT_CONTEXT object at 0x000001D0103736B0><o:p></o:p></p>
<p class="MsoNormal">2 CertEnumCertificateContextProperties returned: []<o:p></o:p></p>
<p class="MsoNormal">3 cert.Subject: w22test001.manross.net<o:p></o:p></p>
<p class="MsoNormal">4 cert Serial Number: redacted<o:p></o:p></p>
<p class="MsoNormal">5 Issuer: redacted<o:p></o:p></p>
<p class="MsoNormal">6 NotBefore: redacted<o:p></o:p></p>
<p class="MsoNormal">7 NotAfter: redacted<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">1 Cert: <PyCERT_CONTEXT object at 0x000001D010373920><o:p></o:p></p>
<p class="MsoNormal">2 CertEnumCertificateContextProperties returned: [2, 11]<o:p></o:p></p>
<p class="MsoNormal">3 cert.Subject: w22test001.manross.net<o:p></o:p></p>
<p class="MsoNormal">4 cert Serial Number: redacted<o:p></o:p></p>
<p class="MsoNormal">5 Issuer: redacted<o:p></o:p></p>
<p class="MsoNormal">6 NotBefore: redacted<o:p></o:p></p>
<p class="MsoNormal">7 NotAfter: redacted<o:p></o:p></p>
<p class="MsoNormal"><br>
Please and thank you,<o:p></o:p></p>
<p class="MsoNormal">Steven<o:p></o:p></p>
</div>
</body>
</html>