Public/Import-PWSHYBKPIVCertificate.ps1
|
function Import-PWSHYBKPIVCertificate { <# .SYNOPSIS Imports a certificate into a PIV slot of a locally attached YubiKey. .DESCRIPTION Wraps "yubico-piv-tool.exe --action import-certificate". Overwrites any certificate already present in the target slot with no way to recover it, so this cmdlet supports -WhatIf/-Confirm with ConfirmImpact 'High'. Throws on failure rather than returning a value, matching Import- verb convention. Accepts the "import-certificate" action's config-declared options (-Slot, -Input, -KeyFormat, -Password, -ManagementKey, -Compress, -Reader) as dynamic parameters built from Config\Posh-YBKPIV.json. .PARAMETER Slot The PIV slot to import the certificate into, e.g. '9a'. .PARAMETER Input Path to the certificate file to import. .PARAMETER KeyFormat File format of the certificate: PEM, PKCS12, GZIP, DER, or SSH. Defaults to PEM when omitted. .PARAMETER Password Password protecting the input file (e.g. a PKCS#12 bundle), as a SecureString. .PARAMETER ManagementKey The management key authorizing the operation, as a SecureString. Defaults to yubico-piv-tool.exe's built-in default management key when omitted. .PARAMETER Compress Store the certificate compressed on the device. .PARAMETER Reader Name of the smart card reader to target, when more than one is attached. If omitted, yubico-piv-tool.exe uses its own default reader selection. .INPUTS None. This cmdlet does not accept pipeline input. .OUTPUTS None. Throws a terminating error on failure; produces no output on success. .NOTES -Slot, -Input, -KeyFormat, -Password, -ManagementKey, -Compress, and -Reader are declared dynamically from Config\Posh-YBKPIV.json and therefore do not appear in Get-Help's PARAMETERS/SYNTAX sections. Run `Get-Command Import-PWSHYBKPIVCertificate -Syntax` for the authoritative, current parameter list. .EXAMPLE Import-PWSHYBKPIVCertificate -Slot '9a' -Input 'C:\certs\cert.pem' Imports the certificate from cert.pem into slot 9a after confirmation. .LINK https://developers.yubico.com/yubico-piv-tool/Actions/ .LINK Get-PWSHYBKPIVCertificate .LINK Remove-PWSHYBKPIVCertificate #> [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'High')] param() DynamicParam { $dynamicConfig = Read-PWSHYBKPIVConfigFile Get-PWSHYBKPIVActionParameter -Action 'import-certificate' -CmdletWrapping $dynamicConfig.cmdletWrapping } begin { $config = Read-PWSHYBKPIVConfigFile Write-PWSHYBKPIVLog -Config $config -Level Debug -CmdletName $MyInvocation.MyCommand.Name ` -Message 'Cmdlet invoked' -BoundParameters $PSBoundParameters $architecture = Resolve-PWSHYBKPIVArchitecture -Architecture $config.installation.architecture $exePath = Get-PWSHYBKPIVInstallPath -Installation $config.installation -Architecture $architecture if (-not (Test-Path -Path $exePath -PathType Leaf)) { throw "yubico-piv-tool.exe was not found at '$exePath'. Run Install-PWSHYBKPIVTool first." } } end { $slotDescription = "PIV slot $($PSBoundParameters['Slot'])" if (-not $PSCmdlet.ShouldProcess($slotDescription, 'Import certificate')) { return } try { $null = Invoke-PWSHYBKPIVTool -ExePath $exePath -Action 'import-certificate' ` -CmdletWrapping $config.cmdletWrapping -BoundParameters $PSBoundParameters Write-PWSHYBKPIVLog -Config $config -Level Information -CmdletName $MyInvocation.MyCommand.Name ` -Message "Certificate imported into $slotDescription" } catch { Write-PWSHYBKPIVLog -Config $config -Level Error -CmdletName $MyInvocation.MyCommand.Name -Message "Certificate import failed: $_" throw } } } |