Install certificate

What it does

Installs a certificate from the vault into the Windows machine certificate store. It runs before OOBE, so the certificate is present before any network or VPN flow that needs it — a corporate root CA, a code-signing certificate, or a client-auth certificate for VPN.

You can stack multiple instances of this step in one template to install several certificates.

Options

Option	What it controls
Certificate type	Public certificate (.cer/.der — root CA, code-signing) or PFX with private key (client-auth cert for VPN).
Certificate (Base64)	The vault secret holding the certificate content. Required.
PFX password	The vault secret for the PFX private key. Only used — and only needed — when the type is PFX.
Certificate store	Where it lands: Trusted Root CAs, Intermediate CAs, Personal, or Trusted Publishers.

Good to know

• Cert vs PFX are genuinely different. A public certificate has no private key. A PFX bundles an encrypted private key that needs its own password to unlock — that's why the PFX password is a separate field.
• Clear failures. If the configured certificate can't be installed — for example a PFX was uploaded but the type was left as public certificate — the step reports a plain-language message telling you it's a problem with the certificate you configured, not the device, so you know exactly what to fix.
• If installation fails, the setup stops by default.

Part of the step catalogue.