How to Grant permission to user on Certificate private key using powershell?

by

Here is the Answer.

Created a powershell script file AddUserToCertificate.ps1

Here is the content for script file.

param(
    [string]$userName,
    [string]$permission,
    [string]$certStoreLocation,
    [string]$certThumbprint
);
# check if certificate is already installed
$certificateInstalled = Get-ChildItem cert:$certStoreLocation | Where thumbprint -eq $certThumbprint

# download & install only if certificate is not already installed on machine
if ($certificateInstalled -eq $null)
{
    $message="Certificate with thumbprint:"+$certThumbprint+" does not exist at "+$certStoreLocation
    Write-Host $message -ForegroundColor Red
    exit 1;
}else
{
    try
    {
        $rule = new-object security.accesscontrol.filesystemaccessrule $userName, $permission, allow
        $root = "c:\programdata\microsoft\crypto\rsa\machinekeys"
        $l = ls Cert:$certStoreLocation
        $l = $l |? {$_.thumbprint -like $certThumbprint}
        $l |%{
            $keyname = $_.privatekey.cspkeycontainerinfo.uniquekeycontainername
            $p = [io.path]::combine($root, $keyname)
            if ([io.file]::exists($p))
            {
                $acl = get-acl -path $p
                $acl.addaccessrule($rule)
                echo $p
                set-acl $p $acl
            }
        }
    }
    catch 
    {
        Write-Host "Caught an exception:" -ForegroundColor Red
        Write-Host "$($_.Exception)" -ForegroundColor Red
        exit 1;
    }    
}

exit $LASTEXITCODE

Now run it as part of deployment. Example to running above script in powershell console window. 

C:\>.\AddUserToCertificate.ps1 -userName testuser1 -permission read -certStoreLocation \LocalMachine\My -certThumbprint 1fb7603985a8a11d3e85abee194697e9784a253

this example give read permission to user testuser1 on certificate that in installed in \LocalMachine\My and has thumb print 1fb7603985a8a11d3e85abee194697e9784a253

If you are using ApplicationPoolIdentity then you username will be ‘IIS AppPool\AppPoolNameHere’

Note: You will need to use ‘ ‘ as there is a space between IIS and AppPool.

More Related Contents:

  1. String handling from Powershell script
  2. Powershell script to delete 15 days old .txt files [duplicate]
  3. How to create a zip archive with PowerShell?
  4. How to run an EXE file in PowerShell with parameters with spaces and quotes
  5. Use PowerShell to run virus scan on multiple servers
  6. Unable to access UNC Paths in Powershell remote session
  7. Fastest Way to get a uniquely index item from the property of an array
  8. PowerShell IE9 ComObject has all null properties after navigating to webpage
  9. PowerShell script runs when pasted into the PowerShell window, but not when run from shortcut
  10. save PSCredential in the file
  11. How do I write a PowerShell script that accepts pipeline input?
  12. PowerShell’s Invoke-RestMethod equivalent of curl -u (Basic Authentication)
  13. How do I Start a job of a function i just defined?
  14. Remove files and foldes on Azure before a new deploy from VSTS
  15. try, catch doesent seem to work
  16. Specifying *.xls filter in Get-ChildItem also returns *.xlsx results
  17. Inserting a date into SQL
  18. Run a [Code] or PowerShell script in Inno Setup compiler
  19. Replacing a string with a variable in Get-ADGroup
  20. Create an incrementing variable from 2 variables in PowerShell
  21. Can the following Nested foreach loop be simplified in PowerShell?
  22. Add Write-Progress to Get-Job/Wait-Job
  23. Powershell with exchange– How do I append all verbose output to a file
  24. How to handle command-line arguments in PowerShell
  25. How to send email with PowerShell
  26. powershell function switch param with string array
  27. Using PowerShell to remove lines from a text file if it contains a string
  28. Jenkins powershell plugin is running 32 bit Powershell and I need 64bit
  29. Powershell – Output Color for certain results
  30. Pass function as a parameter

Leave a Comment