Import-certificate is not including "Properties Only" fields 1

[ls62]

Hi,

When using the import-certificate command it is not importing the "properties only" fields. If I import the same exact .cer file using the mmc certificate snap-in it does import those values/fields.
Is this a known issue or is there something additional I need to do to import the fields highlighted in green below?

Here's a snip of the powershell code I'm using:
$DestFilePath="C:\certname.cer"
$certStore = "Cert:\LocalMachine\Root"
Import-Certificate -FilePath $DestFilePath -CertStoreLocation $certStore

A) On one server I used the MMC snap-in to import the certificate into the Root store and it worked fine.



B) On a 2nd server I used the PS script above, and it imported, but did not include any of the "properties only" fields (Friendly name, Enhanced Key Usage, Extended Validation)

 

[SnapAPKProu435]

It looks like when using Import-Certificate in PowerShell, only the raw certificate data is imported, but not the additional metadata such as Friendly Name, Enhanced Key Usage, or Extended Validation. The MMC snap-in, however, applies these properties during import.


To work around this, you may need to manually set the missing properties after importing. For example, you can use the following PowerShell commands to update the Friendly Name and Enhanced Key Usage:

$cert = Get-Item "Cert:\LocalMachine\Root\<Thumbprint>"
$cert.FriendlyName = "Your Friendly Name"


For Enhanced Key Usage (EKU), you may need to use certutil or a separate API call.


Let me know if you need further help troubleshooting this!

 

[ls62]

It looks like when using Import-Certificate in PowerShell, only the raw certificate data is imported, but not the additional metadata such as Friendly Name, Enhanced Key Usage, or Extended Validation. The MMC snap-in, however, applies these properties during import.


To work around this, you may need to manually set the missing properties after importing. For example, you can use the following PowerShell commands to update the Friendly Name and Enhanced Key Usage:

$cert = Get-Item "Cert:\LocalMachine\Root\<Thumbprint>"
$cert.FriendlyName = "Your Friendly Name"


For Enhanced Key Usage (EKU), you may need to use certutil or a separate API call.


Let me know if you need further help troubleshooting this!

Thank you for the suggestion. I too, found that I could manually update the additional metadata in other ways, but it seems odd that they wouldn't build that into the command or function since those fields exist in the .cer file.

I'll work on using some of these other methods.

On additional comment we found was to use a GPO to apply the certificate, but I have not tried that yet.

Thanks again,
Lee