Installing Security Certificates for Students

[gtg93]

Other than Group Policy, is there a way that I can install a security certificate on a number of PCs so it is then valid for every user? I don't mind going round the computers individually...

 

I have tried it with certmgr.exe with a batch file but when it's run by the student I get the error: Error: Failed to open the source store

 

Even though the certificate is in the directory sepcified and the students have full access.

 

Or if not, is there a physical directory I can copy the certificate into for it to be applied?

 

Cheers in advance for any help

[box_l]

\\UNC-PATH\certmgr -add -c Certificate.cer -s -r localmachine root

 

Is this your syntax?

 

BoX

[gtg93]

Yes that's the one... works fine for me but not for others as a bat file running on startup

[box_l]

Do you mean a startup script?

Maybe the cert store is not initialised that soon in the boot process?

Try later as a logon script.

 

When does it work fine for you, when you are logged on? Or at startup?

 

BoX

[Arthur]

I did this quite recently using Wix and created an MSI which installs a certificate. Example code shown below (and attached) if you want to give it a try. Just change the bits in red.

 

Product.wxs

	 xmlns:iis="http://schemas.microsoft.com/wix/IIsExtension"
 xmlns:util="http://schemas.microsoft.com/wix/UtilExtension">
 


 
 	
 
  			   Name="$(var.ProductName)" 
		   Language="2057" 
		   Version="1.0.0" 
		   Manufacturer="$(var.ManufacturerName)" 
		   UpgradeCode="01100111-0110-0101-0110-010101101011">
 
					 Platform="x86" 
			 Compressed="yes" 
			 InstallScope="perMachine" 
			 InstallPrivileges="elevated" />

	

	
	
		
	
	
		=501)]]>
	

	

	
		
			
		 
			  
												  Id="Certificate.RootCA"
							  Name="$(var.ProductName)"
							  Request="no"
							  StoreLocation="localMachine"
							  StoreName="root"
							  Overwrite="no"
							  BinaryKey="RootCA" />
			  
			  
			
		
	
   
					 Title="$(var.ProductName)" 
			 Description="The core files required to install the certificate." 
			 Level="1" 
			 ConfigurableDirectory="INSTALLDIR" 
			 Absent="disallow" 
			 AllowAdvertise="no" 
			 Display="expand">
			
			 
	

	

	
	
	
	

	
		
		
	

 

 

CreateMSI.cmd

@echo off
SET NAME=Security Certificate
SET PATH=%PATH%;"%ProgramFiles%\Windows Installer XML v3.6\bin"

echo // Compiling
candle.exe -v -nologo -ext WixUtilExtension.dll -ext WixIISExtension.dll -fips -out .\ .\Source\*.wxs

echo. & echo // Linking
light.exe -nologo -out "%NAME%.msi" "*.wixobj" -cultures:en-US -ext WiXUtilExtension.dll -ext WixIISExtension.dll -ext WixUIExtension.dll -dcl:high

:: Tidy up
del /F /S /Q *.wixobj
del /F /S /Q *.wixpdb

WixCertificate.7z

[gtg93]

Do you mean a startup script?

Maybe the cert store is not initialised that soon in the boot process?

Try later as a logon script.

 

When does it work fine for you, when you are logged on? Or at startup?

 

BoX

 

Thanks for the reply and sorry for my late one,

 

I'm running it as a log on script but the students get the error I mentioned above but it works fine for me (other scripts at logon usually work fine and they're able to install the certificate normally so why not a script to install it?)

 

I did this quite recently using Wix and created an MSI which installs a certificate. Example code shown below (and attached) if you want to give it a try. Just change the bits in red.

 

Thanks,

I'll see what I can make of it

[gtg93]

I've had a look at this and can't seem to get it working...

I've installed Wix but am I right in saying Wix needs Visual Studio to work?

[Arthur]

WiX will definitely work without Visual Studio. Probably the best thing to do would be to download and run Wix36.exe from here just to make sure you have the latest version of WiX installed. Next, download WixCertificate.7z from my post above and extract its contents to a folder on your HDD. You will need 7-Zip to do this if you don't already have it installed.

 

In the 'Source' folder you will find two files...

 

Product.wxs

. Open this in Notepad (or your favourite text editor) and then change the bits I highlighted in red above. Save the file and then close it.

 

SecurityCertificate.cer

. This is just an example certificate and can be deleted or overwritten. If your certificate has a different filename make sure it matches the filename which is in the WXS file (under the Binary element with an Id of "RootCA").

 

Finally, double-click _MakeMSI.cmd and after a few seconds you should have an MSI.

 

If this doesn't work, let me know as I have something else you can try.

[Arthur]

I have made a few changes to the WiX and batch files. New versions shown below and attached should you need them?

 

Product.wxs

     xmlns:iis="http://schemas.microsoft.com/wix/IIsExtension" 
    xmlns:util="http://schemas.microsoft.com/wix/UtilExtension">

 
 
 
 
 
 
 
   
   
   
   
   
   
   =501)]]>
   
   
   
   
     
       
         
         
           
                                            Name="$(var.ProductName)" 
                              Request="no" 
                              StoreLocation="localMachine" 
                              StoreName="root" 
                              Overwrite="no" 
                              BinaryKey="RootCA" />
           
         
       
     
   
   
                Title="$(var.ProductName)" 
            Description="The core files required to install the certificate." 
            Level="1" 
            ConfigurableDirectory="INSTALLDIR" 
            Absent="disallow" 
            AllowAdvertise="no" 
            Display="collapse">
            
     
   
   
   
   
   
   
   
   
   
   
     
     
   
   
 

 

CreateMSI.cmd

@echo off
SETLOCAL
SET NAME=Security Certificate

IF NOT EXIST "%WIX%" (
   echo.
   echo WiX is not installed and/or %%WIX%% system variable is not set.
   echo.
   echo The latest release can be downloaded from:
   echo http://wix.sourceforge.net/releases/
   echo.
   PAUSE
   exit /b 1
   ) ELSE (
   
     SET PATH=%PATH%;"%WIX%bin"

     echo.
     echo ------------------------------------------------------------------------------
     echo  Compiling...
     echo ------------------------------------------------------------------------------
     candle.exe -v -nologo -ext WixUtilExtension.dll -ext WixIISExtension.dll -fips -out .\ .\Source\*.wxs

     echo.
     echo ------------------------------------------------------------------------------
     echo  Linking...
     echo ------------------------------------------------------------------------------
     light.exe -nologo -out "%NAME%.msi" "*.wixobj" -cultures:en-US -ext WiXUtilExtension.dll -ext WixIISExtension.dll -ext WixUIExtension.dll -dcl:high
     if ERRORLEVEL 1 goto error
     
     :tidyup
     echo.
     echo ------------------------------------------------------------------------------
     echo  Tidying Up...
     echo ------------------------------------------------------------------------------
     del /F /S /Q *.wixobj >nul 2>&1
     del /F /S /Q *.wixpdb >nul 2>&1
     
     goto success
     
     :error
     color 4F
     echo.
     echo //////////////////////////////////////////////////////////////////////////////
     echo  Build failed!
     echo //////////////////////////////////////////////////////////////////////////////
     PAUSE>NUL
     exit /B 1
     
     :success
     echo.
     echo ------------------------------------------------------------------------------
     echo  MSI created successfully 
     echo ------------------------------------------------------------------------------
     echo.
     echo  You will find it here...
     echo.
     echo  "%~dp0%NAME%.msi"
     echo.
     PAUSE
)

ENDLOCAL

WixCertificate.7z

[gtg93]

Thanks,

 

that seems to have worked this time... Think is was a dodgy version of Wix I'd downloaded the first time around