Install Certificate (.cer) to target machine's trustedpublisher Failed

Question

I am attempting to use the following command to install a certificate to a client machine. This is the certificate that I am signing a silverlight XAP file with (exported as .cer without the private key).
certmgr.exe -add .\DigiCert.cer -s -r localMachine trustedpublisher
When I run this command, I get:
Error: Failed to open the distantion Store
CertMgr Failed
The cert is able to be opened and installed using the wizard just fine, however I'm trying to reduce the number of steps the end user has to take to use the silverlight application, and the 5 or so steps the wizard has just adds to their frustration.

Answer 1

As I wasn't making any headway with this, I just decided to make my own cert installer. For those that need it, you can use the following code to install a certificate. I hard-coded the name of the cert file and which store to put it in, which could easily
be converted to parameters.
namespace MyCompany.Cert
using System;
using System.Diagnostics;
using System.IO;
using System.Security.Cryptography.X509Certificates;
using System.Security.Principal;
public class Program
enum ExitCode
Success = 0,
UnauthorizedAccess = 1,
FileNotFound = 2,
UnknownError = 10,
static int Main(string[] args)
try
var tr1 = new TextWriterTraceListener(File.CreateText(@"C:\Temp\CertificateInstallLog.txt"));
Trace.Listeners.Add(tr1);
Trace.WriteLine("Checking for admin rights");
if (!IsUserAdministrator())
Trace.WriteLine("Failed to install certificate: Requires Administrator rights");
return (int)ExitCode.UnauthorizedAccess;
Trace.WriteLine("Have Admin rights, installing certificate");
Trace.WriteLine("Create Store Reference: localMachine trustedPublisher");
var store = new X509Store(StoreName.TrustedPublisher, StoreLocation.LocalMachine);
Trace.WriteLine("Opening Store: Read/Write");
store.Open(OpenFlags.ReadWrite);
Trace.WriteLine("Adding Certificate from file");
var cert = GetCertificate();
Trace.WriteLine("Got certificate from file");
store.Add(cert);
Trace.WriteLine("closing store");
store.Close();
Trace.WriteLine("Exiting");
Trace.Flush();
return (int)ExitCode.Success;
catch (FileNotFoundException ex)
Trace.WriteLine("Failed to install certificate. File not found");
Trace.Flush();
return (int)ExitCode.FileNotFound;
catch (Exception ex)
Trace.WriteLine("Failed to install certificate. " + ex.Message);
Trace.Flush();
return (int)ExitCode.UnknownError;
public static X509Certificate2 GetCertificate()
X509Certificate2 cert;
try
Trace.WriteLine("trying path 'DigiCert.cer'");
cert = new X509Certificate2("DigiCert.cer");
catch (System.Security.Cryptography.CryptographicException)
Trace.WriteLine("Path 'DigiCert.cer' failed");
var path = string.Empty;
try
path = @"C:\Program Files" +
(Directory.Exists(@"C:\Program Files (x86)") ? @" (x86)" : string.Empty) +
@"\<someprogramfolder>\DigiCert.cer";
Trace.WriteLine("trying path " + path);
cert = new X509Certificate2(path);
catch (System.Security.Cryptography.CryptographicException ex)
Trace.WriteLine("Path '{0}' failed", path);
throw ex;
return cert;
/// <summary>Query if this object is user administrator.</summary>
/// <returns>true if user administrator, false if not.</returns>
public static bool IsUserAdministrator()
var user = WindowsIdentity.GetCurrent();
if (user == null)
throw new NullReferenceException("Could not determine windows identity");
var myPrincipal = new WindowsPrincipal(user);
if (myPrincipal.IsInRole(WindowsBuiltInRole.Administrator)) { return true; }
Trace.WriteLine("You need to run the application using the 'Run as Administrator' option");
return false;
Don't forget to include an app.manifest that tells the program to always request admin rights:
<?xml version="1.0" encoding="utf-8"?>
<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app" />
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<!-- UAC Manifest Options
If you want to change the Windows User Account Control level replace the
requestedExecutionLevel node with one of the following.
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
<requestedExecutionLevel level="highestAvailable" uiAccess="false" />
Specifying requestedExecutionLevel node will disable file and registry virtualization.
If you want to utilize File and Registry Virtualization for backward
compatibility then delete the requestedExecutionLevel node.
-->
<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
</requestedPrivileges>
<applicationRequestMinimum>
<defaultAssemblyRequest permissionSetReference="Custom" />
<PermissionSet class="System.Security.PermissionSet" version="1" ID="Custom" SameSite="site" Unrestricted="true" />
</applicationRequestMinimum>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
</application>
</compatibility>
</asmv1:assembly>