How to Create PFX Certificate Profiles in Configuration Manager

How to create and deploy a Personal Information Exchange (PFX) certificate profile

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, expand Compliance Settings, expand Company Resource Access, and then click Certificate Profiles.

3. On the Home tab, in the Create group, click Create Certificate Profile. The Create Certificate Profile wizard opens.

4. On the General page of the Create Certificate Profile Wizard, specify the following information:

   - **Name**: Enter a unique name for the certificate profile. You can use a maximum of 256 characters.
   
   - **Description**: Provide a description that gives an overview of the certificate profile and other relevant information that helps to identify it in the Configuration Manager console. You can use a maximum of 256 characters.
   
   - **Specify the type of certificate profile that you want to create**: Choose one of the following certificate profile types:
   
       - **Trusted CA certificate**: Select this certificate profile type if you want to deploy a trusted root certification authority (CA) or intermediate CA certificate to form a certificate chain of trust when the user or device must authenticate another device. For example, the device might be a Remote Authentication Dial-In User Service (RADIUS) server or a virtual private network (VPN) server. You must also configure a trusted CA certificate profile before you can create a SCEP certificate profile. In this case, the trusted CA certificate must be the trusted root certificate for the CA that will issue the certificate to the user or device.
   
       - **Simple Certificate Enrollment Protocol (SCEP) settings**: Select this certificate profile type if you want to request a certificate for a user or device, by using the Simple Certificate Enrollment Protocol and the Network Device Enrollment Service role service.
   
       - **Personal Information Exchange – PKCS \#12 (PFX) settings – import**: When using Configuration Manager 2012 R2 SP1 with Microsoft Intune, select this to import a PFX certificate. This option is not available in Configuration Manager without Intune, and you can deploy only to Intune-managed devices.
   

5. In the Certificate Properties window of the Create Certificate Profile wizard, specify where the PFX certificate will be stored on targeted devices.

   - **Install to Trusted Platform Module (TPM) if present**
   
   - **Install to Trusted Platform Module (TPM), otherwise fail**
   
   - **Install to Software Key Storage Provider**
   

   Click Next.

6. In the Supported Platforms window of the Create Certificate Profile wizard, specify which operating systems or platforms that can receive the imported PFX file.

   - **Windows 10**
   
   - **iPhone**
   
   - **iPad**
   
   - **Android**
   

7. Click Next, review the Summary page, and then close the wizard.

8. The certificate profile containing the PFX file is now available from the Certificate Profiles workspace. In the Assets and Compliance workspace go Compliance Settings > Company Resource Access > Certificate Profiles and right-click to deploy the new certificate to User collections.

9. Using the SDK for Windows 8.1 available from the Download Center (https://go.microsoft.com/fwlink/?LinkId=613525, deploy a Create PFX Script. The Create PFX Script adds an SMS_ClientPfxCertificate class to the SDK. This class includes the following methods:

   - ImportForUser
   
   - DeleteForUser
   

   Sample script:

     $EncryptedPfxBlob = "<blob>"
     $Password = "abc"
     $ProfileName = "PFX_Profile_Name"
     $UserName = "ComputerName\Administrator"
   
   
     #New pfx
     $WMIConnection = ([WMIClass]"\\nksccm\root\SMS\Site_MDM:SMS_ClientPfxCertificate")
         $NewEntry = $WMIConnection.psbase.GetMethodParameters("ImportForUser")
         $NewEntry.EncryptedPfxBlob = $EncryptedPfxBlob
         $NewEntry.Password = $Password
         $NewEntry.ProfileName = $ProfileName
         $NewEntry.UserName = $UserName
     $Resource = $WMIConnection.psbase.InvokeMethod("ImportForUser",$NewEntry,$null)
   

   The following script variables must be modified for your script:

   - \<blob\> = The PFX base64-encrypted blob
   
   - $Password = The password for the PFX file
   
   - $ProfileName = The name of the PFX profile
   
   - ComputerName = Name of host computer