Using Inno Setup, how to import a certificate .cer file?

Question

Can I use Inno Setup to import a .cer file (a certificate)?

How can I do it?

I need to create a certificate installer for Windows XP, Windows Vista and Windows 7.

Centaur

I was thinking about using a command line with Certmgr.exe utility. Would it work with all windows system? – Centaur

Certmgr.exe is not part of Windows, so you have to bundle it in your installer. I think it should work with all Windows releases, as it is part of Windows SDK. – Made

Answer 1

Add Certmgr.exe and yourcertificate.cer into setup:

[Files]
Source: CertMgr.exe; DestDir: {app}; Flags: deleteafterinstall
Source: yourcertificate.cer; DestDir: {app}; Flags: deleteafterinstall

And in [Run] section, write something like this:

Filename: {app}\CertMgr.exe; Parameters: "-add -all -c yourcertificate.cer -s -r localmachine trustedpublisher"; Flags: waituntilterminated runhidden;

Bultman

In my case its self-signed certificate. so that line localmachine ended with root – Billhead

Answer 2

Actually the CertMgr.exe is not available on all PCs and furthermore it does not appear to be redistributable (as hinted by @TLama); and besides you don't even need it.

CertUtil is available on every Windows machine (that I have tested) and works perfectly:

[Run]
Filename: "certutil.exe"; Parameters: "-addstore ""TrustedPublisher"" {app}\MyCert.cer"; \
    StatusMsg: "Adding trusted publisher..." 

Cain

@MartinPrikryl Admittedly I could have done more testing. I only discovered this yesterday and so have not tested exhaustively; so far only on Win 10 machines. But one is VM on Azure, 2 are regular PCs without visual studio, dotNets etc. (so no CertMgr.exe available), and then there is my DevPC which has CertMgr but CertUtil also works on it. – Cain

It is stated here that certutil.exe is shipped with Windows 7 and later. For earlier versions download it from Microsoft download (ref) – Density

Nice solution. It's worth noting that calling certutil requires elevated privileges so this won't work for user profile installers. – Hypertrophy

Answer 3

The reply by SlowLearner and Martin Prikryl is correct. However, a comment states the command requires elevated privileges. If you use the -user command it will access the user store therefore not requiring elevation:

[Run]
Filename: "certutil.exe"; Parameters: "-user -addstore ""Root"" {app}\MyCert.cer"; \
StatusMsg: "Adding root certificate..."

Mak