User/computer delegation error when importing certificates
I'm doing a plain and simple certificate import, but I'm getting an error I haven't seen before:
Exception calling "Import" with "3" argument(s): "The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation."
Anyone know what could cause this?
$cred = Get-Credential remoteuser
$certs = (Get-Content -Raw C:\certs\cert01.pfx),(Get-Content -Raw C:\certs\cert02.pfx),(Get-Content -Raw C:\certs\cert03.pfx)
Invoke-Command -ComputerName dmz01,dmz02 -Credential $cred -ScriptBlock {
if(-not (Test-Path D:\software\certs)) { mkdir D:\software\certs\ }
$using:certs[0] | Set-Content D:\software\certs\cert01.pfx
$using:certs[1] | Set-Content D:\software\certs\cert02.pfx
$using:certs[2] | Set-Content D:\software\certs\cert03.pfx
$store = Get-Item cert:\LocalMachine\TrustedPeople
$store.Open('ReadWrite')
'cert01.pfx','cert02.pfx','cert03.pfx' | % {
try {
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cert.Import("D:\software\certs\$_", 'password', 'DefaultKeySet')
$store.Add($cert)
}
catch {
Write-Warning "$_"
}
}
$store.Close()
}
4 comments · 76% upvoted · other discussions
Kerberos double-hop auth issue ? Problem is i don't see where's the second hop :)
Did you try to check "trust this computer for delegation to any service" on dmz01/2 AD computer account ?
pertymoose [OP] 1 points · Feb 2017
Me either. I haven't had this issue before, which is why it's bothering me. And I've only got it on my pre-production platform, not any of the others, which just makes it more weird.
I'll try fiddling a bit with the kerberos delegation, but I'm really not very optimistic that it's going to fix anything.