function Add-DbaComputerCertificate {

<#

[CmdletBinding(SupportsShouldProcess, ConfirmImpact = "Low")]

param (

[DbaInstance[]]$ComputerName = $env:COMPUTERNAME,

[PSCredential]$Credential,

[Alias("Password")]

[SecureString]$SecurePassword,

[parameter(ValueFromPipeline)]

[System.Security.Cryptography.X509Certificates.X509Certificate2[]]$Certificate,

[string]$Path,

[string]$Store = "LocalMachine",

[string]$Folder = "My",

[ValidateSet("EphemeralKeySet", "Exportable", "PersistKeySet", "UserProtected", "NonExportable")]

[string[]]$Flag = @("Exportable", "PersistKeySet"),

[switch]$EnableException

)

begin {

if ("NonExportable" -in $Flag) {

$flags = ($Flag | Where-Object { $PSItem -ne "Exportable" -and $PSItem -ne "NonExportable" } ) -join ","

# Ensure the correct store is used

if (-not $flags) {

if ($Store -eq "LocalMachine") {

$flags = "MachineKeySet"

} else {

$flags = "UserKeySet"

}

} else {

if ($Store -eq "LocalMachine") {

$flags += ",MachineKeySet"

} else {

$flags += ",UserKeySet"

}

}

} else {

$flags = $Flag -join ","

}

Write-Message -Level Verbose -Message "Flags: $flags"

# Track if we're dealing with a certificate collection from a file

$isCollection = $false

$collectionData = $null

if ($Path) {

if (-not (Test-Path -Path $Path)) {

Stop-Function -Message "Path ($Path) does not exist." -Category InvalidArgument

return

}

try {

# Read file bytes and import locally to get certificate collection

$fileBytes = [System.IO.File]::ReadAllBytes($Path)

# Use X509Certificate2Collection to import the full certificate chain

$certCollection = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection

# Handle password conversion for password-protected certificates (PFX files)

$plainPassword = $null

$ptr = [IntPtr]::Zero

if ($SecurePassword) {

# Convert SecureString to plain text password for import/export operations

# Using plain text for both Import() and Export() in all PowerShell versions

# This is standard practice for .NET certificate operations

$ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocUnicode($SecurePassword)

$plainPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($ptr)

}

Write-Message -Level Verbose -Message "Importing Path: $Path"

try {

# Import using plain text password (or null for non-password-protected certificates)

# Works reliably in all PowerShell versions v3+

# This import intentionally doesn't use $flags to allow re-export

$null = $certCollection.Import($fileBytes, $plainPassword, "Exportable, PersistKeySet")

# Export the entire collection as a single PFX to preserve the chain

# This re-exports with the password, creating a fresh encrypted byte array that can be passed to remote

$collectionData = $certCollection.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::PFX, $plainPassword)

$isCollection = $true

# Still set $Certificate so the process block knows we have something to process

$Certificate = @($certCollection)

} finally {

# Always clean up the plain text password from memory

if ($ptr -ne [IntPtr]::Zero) {

[System.Runtime.InteropServices.Marshal]::ZeroFreeGlobalAllocUnicode($ptr)

}

}

} catch {

Stop-Function -Message "Can't import certificate." -ErrorRecord $_

return

}

}

#region Remoting Script

$scriptBlock = {

param (

$CertificateData,

[string]$PlainPassword,

$Store,

$Folder,

$flags

)

# Use X509Certificate2Collection to import the full certificate chain

$certCollection = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection

Write-Verbose -Message "Importing certificate chain to $Folder\$Store using flags: $flags"

$certCollection.Import($CertificateData, $PlainPassword, $flags)

$tempStore = New-Object System.Security.Cryptography.X509Certificates.X509Store($Folder, $Store)

$tempStore.Open("ReadWrite")

# Import all certificates in the chain

$importedCerts = @()

foreach ($cert in $certCollection) {

$tempStore.Add($cert)

$importedCerts += $cert.Thumbprint

Write-Verbose -Message "Imported certificate: $($cert.Subject) (Thumbprint: $($cert.Thumbprint))"

}

$tempStore.Close()

Write-Verbose -Message "Searching Cert:\$Store\$Folder for imported certificates"

Get-ChildItem "Cert:\$Store\$Folder" -Recurse | Where-Object { $_.Thumbprint -in $importedCerts }

}

#endregion Remoting Script

}

process {

if (Test-FunctionInterrupt) { return }

if (-not $Certificate) {

Stop-Function -Message "You must specify either Certificate or Path" -Category InvalidArgument

return

}

# Convert SecureString to plain text for passing to remote scriptblock

# (PowerShell remoting encrypts the connection, so this is safe)

$plainPassword = $null

$ptr = [IntPtr]::Zero

if ($SecurePassword) {

$ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocUnicode($SecurePassword)

$plainPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($ptr)

}

try {

# If we have a collection from a file, import it as a single unit to preserve the chain

if ($isCollection -and $collectionData) {

foreach ($computer in $ComputerName) {

if ($PSCmdlet.ShouldProcess("$computer", "Attempting to import cert collection")) {

if ("UserProtected" -in $Flag -and -not $computer.IsLocalHost) {

Stop-Function -Message "UserProtected flag is only valid for localhost because it causes a prompt, skipping for $computer" -Continue

}

try {

Invoke-Command2 -ComputerName $computer -Credential $Credential -ArgumentList $collectionData, $plainPassword, $Store, $Folder, $flags -ScriptBlock $scriptBlock -ErrorAction Stop |

Select-DefaultView -Property FriendlyName, DnsNameList, Thumbprint, NotBefore, NotAfter, Subject, Issuer

} catch {

Stop-Function -Message "Failure" -ErrorRecord $_ -Target $computer -Continue

}

}

}

} else {

# Handle individual certificates from pipeline

foreach ($cert in $Certificate) {

try {

# Export requires plain text password

$certData = $cert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::PFX, $plainPassword)

} catch {

Stop-Function -Message "Can't export certificate" -ErrorRecord $_ -Continue

}

foreach ($computer in $ComputerName) {

if ($PSCmdlet.ShouldProcess("$computer", "Attempting to import cert")) {

if ("UserProtected" -in $Flag -and -not $computer.IsLocalHost) {

Stop-Function -Message "UserProtected flag is only valid for localhost because it causes a prompt, skipping for $computer" -Continue

}

try {

Invoke-Command2 -ComputerName $computer -Credential $Credential -ArgumentList $certdata, $plainPassword, $Store, $Folder, $flags -ScriptBlock $scriptBlock -ErrorAction Stop |

Select-DefaultView -Property FriendlyName, DnsNameList, Thumbprint, NotBefore, NotAfter, Subject, Issuer

} catch {

Stop-Function -Message "Failure" -ErrorRecord $_ -Target $computer -Continue

}

}

}

}

}

} finally {

# Always clean up the plain text password from memory

if ($ptr -ne [IntPtr]::Zero) {

[System.Runtime.InteropServices.Marshal]::ZeroFreeGlobalAllocUnicode($ptr)

}

}

}

}