How to Grant permission to user on Certificate private key using powershell?

Here is the Answer.

Created a powershell script file AddUserToCertificate.ps1

Here is the content for script file.

param(    [string]$userName,    [string]$permission,    [string]$certStoreLocation,    [string]$certThumbprint);# check if certificate is already installed$certificateInstalled = Get-ChildItem cert:$certStoreLocation | Where thumbprint -eq $certThumbprint# download & install only if certificate is not already installed on machineif ($certificateInstalled -eq $null){    $message="Certificate with thumbprint:"+$certThumbprint+" does not exist at "+$certStoreLocation    Write-Host $message -ForegroundColor Red    exit 1;}else{    try    {        $rule = new-object security.accesscontrol.filesystemaccessrule $userName, $permission, allow        $root = "c:\programdata\microsoft\crypto\rsa\machinekeys"        $l = ls Cert:$certStoreLocation        $l = $l |? {$_.thumbprint -like $certThumbprint}        $l |%{            $keyname = $_.privatekey.cspkeycontainerinfo.uniquekeycontainername            $p = [io.path]::combine($root, $keyname)            if ([io.file]::exists($p))            {                $acl = get-acl -path $p                $acl.addaccessrule($rule)                echo $p                set-acl $p $acl            }        }    }    catch     {        Write-Host "Caught an exception:" -ForegroundColor Red        Write-Host "$($_.Exception)" -ForegroundColor Red        exit 1;    }    }exit $LASTEXITCODE

Now run it as part of deployment. Example to running above script in powershell console window.

C:\>.\AddUserToCertificate.ps1 -userName testuser1 -permission read -certStoreLocation \LocalMachine\My -certThumbprint 1fb7603985a8a11d3e85abee194697e9784a253

this example give read permission to user testuser1 on certificate that in installed in \LocalMachine\My and has thumb print 1fb7603985a8a11d3e85abee194697e9784a253

If you are using ApplicationPoolIdentity then you username will be 'IIS AppPool\AppPoolNameHere'

Note: You will need to use ' ' as there is a space between IIS and AppPool.

The above answer did not work for me as the $_.privatekey returned null. I managed to get access to the private key and assign 'Read' permissions for my Application Pool as follows:

param ([string]$certStorePath  = "Cert:\LocalMachine\My",[string]$AppPoolName,[string]$certThumbprint)Import-Module WebAdministration$certificate = Get-ChildItem $certStorePath | Where thumbprint -eq $certThumbprintif ($certificate -eq $null){    $message="Certificate with thumbprint:"+$certThumbprint+" does not exist at "+$certStorePath    Write-Host $message -ForegroundColor Red    exit 1;}else{    $rsaCert = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($certificate)    $fileName = $rsaCert.key.UniqueName    $path = "$env:ALLUSERSPROFILE\Microsoft\Crypto\Keys\$fileName"    $permissions = Get-Acl -Path $path    $access_rule = New-Object System.Security.AccessControl.FileSystemAccessRule("IIS AppPool\$AppPoolName", 'Read', 'None', 'None', 'Allow')    $permissions.AddAccessRule($access_rule)    Set-Acl -Path $path -AclObject $permissions}

As an alternate to above script. You can use PowerShell module. I have not tried it myself but module looks good.http://get-carbon.org/index.html

Here is command to set permissionshttp://get-carbon.org/Grant-Permission.html