The command I'm using that is working perfectly for the "Trusted Root Certification Authorities\Certificates is:

$file = (Get-Childitem -Path "D:/Root CA 2.cer")

$file = Import-Certificate -CertStoreLocation cert:\LocalMachine\Root

When it comes to the 6 different certs that need to be imported to the "Trusted Root Certification Authorities" this command works perfectly. Root CA 2, 3, 4, 5, and the two different ECA Root's 2 and 4 all are placed in their location. However, when it comes to the CCEB Interoperability cert, this command also places it in the "Trusted Root Certification Authorities". The CCEB Cert is supposed to be located in the "Untrusted Certificates" location. What confuses me most is that when you use the MMC console and right click import and choose this file, it automatically knows that it's supposed to be in the "Untrusted" location. I thought that the Powershell command would produce the same result, but it doesn't. It keeps placing it in the wrong location. I'm brand new to Powershell and can't find any discussion on this topic. Please help and thank you in advance.

CodePudding user response：

Powershell can use cert:\ paths to browse the certificate store like a file system. Check out the about_Certificate_provider page for more details. Each cert store's name is a little different from what you see in the MMC though.

cert:\LocalMachine\Root is the "Trusted Root Certification Authorities" store, so any certificates you import are placed there when you specify -CertStoreLocation that way

"Untrusted Certificates" is named Disallowed, so you can import like so:

Get-Item "D:\folder\BadCerts.sst" | 
  Import-Certificate -CertStoreLocation "Cert:\LocalMachine\Disallowed"

Powershell can't easily display the certificate trust list (CTL) in the untrusted certs store, but can import just fine