This is a new cmdlet for Exchange Server 2010 SP1. The cmdlet has FileData parameter that accepts certificate raw data in DER encoded format (byte array). However you will encounter an issue in the case when you have a certificate encoded in Base64. This is not an issue for PFX files because Pkcs12 don't support Base64 encoding, but other certificate file types (CER/Pkcs7/SST) support this. And if you have certificate encoded in Base64 you will get error. Let's see why. Here is an example of Base64-encoded certificate:

-----BEGIN CERTIFICATE-----
MIIBqDCCARECAQAwaTELMAkGA1UEBhMCVVMxDjAMBgNVBAgTBVRleGFzMRMwEQYD
VQQHEwpMYXNDb2xpbmFzMRIwEAYDVQQKEwlNaWNyb3NvZnQxDjAMBgNVBAsTBUl0
ZWFtMREwDwYDVQQDFAhOVFZPT0RPTzCBnjANBgkqhkiG9w0BAQEFAAOBjAAwgYgC
gYBxmmAWKbLJHg5TuVyjgzWW0JsY5Shaqd7BDWtqhzy4HfRTW22f31rlm8NeSXHn
EhLiwsGgNzWHJ8no1QIYzAgpDR79oqxvgrY4WS3PXT7OLwIDAQABoAAwDQYJKoZI
hvcNAQEEBQADgYEAVcyI4jtnnV6kMiByiq4Xg99yL0U7bIpEwAf3MIZHS7wuNqfY
acfhbRj6VFHT8ObprKGPmqXJvwrBmPrEuCs4Ik6PidAAeEfoaa3naIbM73tTvKN+
WD30lAfGBr8SZixLep4pMIN/wO0eu6f30cBuoPtDnDulNT8AuQHjkJIc8Qc=
-----END CERTIFICATE-----

You can convert Base64 string to a byte array, but at first you need to remove non-Base64 header and footer. You can do this manually, use one of the standard X509Certificate2 constructor:

$cert = New-Object Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList "PathToAFile\cert.p7b"
Import-ExchangeCertificate -FileData $cert.RawData <optional arguments>

X509Certificate2.RawData property contains certificate in ASN.1 DER encoded format. Also here is another way if you have Quest AD CmdLets v1.4 installed. New Quest AD cmdlets contain several cmdlets for certificate managing. And here is an example how to use these cmdlets for discussed task:

$cert = Import-QADCertificate -File PathToAFile\cert.p7b
Import-ExchangeCertificate -FileData $cert.NativeObject.RawData <optional arguments>

Personally I prefer second solution. This is not only because I was worked with Quest Software dev team on these cmdlets, but because they provide really easy way to perform the most common certificate management tasks. You don't need to know how to deal with X509Certificate2 class or something else. But you may need to know what properties are available for certain class objects. Import-QADCertificate object don't contains RawData or similar property though, but Quest Software provide a compatibility properties that extends cmdlet functionality. In our case there is NativeObject property that represents native X509Certificate2 object. As you know, X509Certificate2 contains required RawData property. Therefore we pass NativeObject.RawData property value to a Import-ExchnageCertificate cmdlet.


Share this article:

Comments:


Post your comment:

Please, solve this little equation and enter result below. Captcha