Utilizing a software package to install per-user certificates
Learn how to easily and efficiently install certificates using a software package for enhanced security and privacy.
Written by
Last published at: November 15th, 2024
In the my.thinscale.com portal under Software Packages -→ General, we have a package that can be customized to install certificates.
Please note you may need to consult with the subject matter expert for the application/service that uses the certificate to see where it requires it to be installed. You also may examine a machine that is already set up with the certificate to check the attributes.
The first step to take when deploying certificates is to collect some information to determine where the certificates should be installed.
- Check if your certificate should be installed to Current User or Local Machine.
If you search for “cert” in Windows it will present you with the Console options for managing user certificates (certmgr.msc) vs local machine/computer certificates (certlm.msc).
First this guide will cover installing a user certificate to the Personal certificates store, “bob.crt”, which is an example certificate.
1. Open the package either in your Management Console or your Package Creator so we can edit it. First add the certificate file you are intending to use to the package in the Install Files tab
2. Next we need to set a Pre-Install Test so that the package will only deploy the certificate if it's missing. The package includes a script that can test if a cert is present with its identifying thumbprint.
a. One method to get the thumbprint is to double-click/open the certificate and look at the details tab to check the thumbprint
b. You can also query via Powershell if the cert has already been installed.
Get-ChildItem -Path Cert:\CurrentUser\My | Select-Object Subject, Thumbprint
2a. Edit the Pre-Install test to insert a Script check similar to below, being sure to replace the certificate thumbprint with the one you're using:
(Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq "921B97842F23474D8961BFD54911C298316AA558"}) -ne $null
2b. For the Test Expression, set it equal to false, similar to above
3. Finally, in the Install Script tab, swap out the $cert with the matching name of the certificate you are deploying. This should work regardless if you have a .pem, .cer, etc.
Option to instead install a machine-wide