User/computer delegation error when importing certificates

I'm doing a plain and simple certificate import, but I'm getting an error I haven't seen before:

Exception calling "Import" with "3" argument(s): "The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation."

Anyone know what could cause this?

$cred = Get-Credential remoteuser

$certs = (Get-Content -Raw C:\certs\cert01.pfx),(Get-Content -Raw C:\certs\cert02.pfx),(Get-Content -Raw C:\certs\cert03.pfx)

Invoke-Command -ComputerName dmz01,dmz02 -Credential $cred -ScriptBlock {

    if(-not (Test-Path D:\software\certs)) { mkdir D:\software\certs\ }

    $using:certs[0] | Set-Content D:\software\certs\cert01.pfx
    $using:certs[1] | Set-Content D:\software\certs\cert02.pfx
    $using:certs[2] | Set-Content D:\software\certs\cert03.pfx

    $store = Get-Item cert:\LocalMachine\TrustedPeople
    $store.Open('ReadWrite')

    'cert01.pfx','cert02.pfx','cert03.pfx' | % {

        try {
            $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
            $cert.Import("D:\software\certs\$_", 'password', 'DefaultKeySet')
            $store.Add($cert)
        }
        catch {
            Write-Warning "$_"
        }

    }

    $store.Close()
}

4 comments · 76% upvoted · other discussions

comments

z0Gz0G

Kerberos double-hop auth issue ? Problem is i don't see where's the second hop :)

Did you try to check "trust this computer for delegation to any service" on dmz01/2 AD computer account ?

pertymoose [OP]

Me either. I haven't had this issue before, which is why it's bothering me. And I've only got it on my pre-production platform, not any of the others, which just makes it more weird.

I'll try fiddling a bit with the kerberos delegation, but I'm really not very optimistic that it's going to fix anything.

markekraus

I guess my question is, why not use GPO to add these certs to the Trusted People store?

pertymoose [OP]

Unfortunately it's a hosted environment where I don't have access to any sort of advanced administrative functionality beyond a powershell interface. If I want to make OS/domain modifications I have to involve IBM. And I really don't want to involve IBM, if it can be avoided.

But it is shaping up to be one of those "no impact changes/their problem" which will take them at least a month to correct.