windows 如何在没有提示的情况下使用 certutil 导入 pfx？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/26609621/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to import a pfx using certutil without prompt?
提问by Amol Manthalkar
I want to import a pfx using cmd. I am using certutils for that. But I am getting a prompt asking to trust the certificate. I want to automatize import so I want to skip the warning prompt. How can I accomplish that?
我想使用 cmd 导入 pfx。我正在为此使用 certutils。但是我收到提示，要求信任该证书。我想自动化导入，所以我想跳过警告提示。我怎样才能做到这一点？
I am using command certutil -f -user -p PASSWORD -importpfx c:\cert.pfx
我正在使用命令 certutil -f -user -p PASSWORD -importpfx c:\cert.pfx
回答by iericzhou
The reason you got a prompt dialog is that you are trying to add a "CA certificate" into the "Trusted Root Certification Authorities" store. In fact, when you use "certutil -f -user -p PASSWORD -importpfx c:\cert.pfx" to import a PFX certificate, two actions happen:
您收到提示对话框的原因是您正在尝试将“CA 证书”添加到“受信任的根证书颁发机构”存储中。实际上，当您使用“certutil -f -user -p PASSWORD -importpfx c:\cert.pfx”导入 PFX 证书时，会发生两个操作：
- Add a personal certificate(which includes the private key) into the "Personal" store.
- Add a CA certificate into the "Trusted Root Certification Authorities" store.
- 将个人证书（包括私钥）添加到“个人”存储中。
- 将 CA 证书添加到“受信任的根证书颁发机构”存储中。
It is the second action that cause the UAC to prompt a warning dialog, since you are trying to add one CA certificate into the "Trusted Root Certification Authorities" store and this means that any web host that holds this certicate will be trusted in the future, this is a very important action and should be treated very discreetly by the user, shouldn't it? So the UAC will warn the user to comfirm this action.
这是导致 UAC 提示警告对话框的第二个操作，因为您正在尝试将一个 CA 证书添加到“受信任的根证书颁发机构”存储中，这意味着持有此证书的任何 Web 主机将来都将受到信任，这是一个非常重要的操作，用户应该非常谨慎地对待，不是吗？所以UAC会警告用户确认这个动作。
There is only one way to suppress the warning dialog, that is "you don't add the CA certificate into the "Trusted Root Certification Authorities" store by doing so:
只有一种方法可以抑制警告对话框，即“您不会通过这样做将 CA 证书添加到“受信任的根证书颁发机构”存储中：
certutil -f -user -p PASSWORD -importpfx c:\cert.pfx NoRoot
Add personal certificate into "Personal" store will not prompt any warning dialog. However, by this way, the web host that holds the CA certificate will not be trusted any more and this can be very frustrating if you use HTTPS to access the web host.
将个人证书添加到“个人”存储中不会提示任何警告对话框。但是，通过这种方式，持有 CA 证书的 Web 主机将不再受信任，如果您使用 HTTPS 访问 Web 主机，这可能会非常令人沮丧。
