Step reference
Install certificate
Install a public certificate or a private-key PFX from the vault into the machine store, before any network or VPN flow that depends on it.
What it does
Installs a certificate from the vault into the Windows machine certificate store. It runs before OOBE, so the certificate is present before any network or VPN flow that needs it: a corporate root CA, a code-signing certificate, or a client-auth certificate for VPN.
You can stack multiple instances of this step in one template to install several certificates.
Options
| Option | What it controls |
|---|---|
| Certificate type | Public certificate (.cer/.der, for a root CA or code-signing) or PFX with private key (client-auth cert for VPN). |
| Certificate (Base64) | The vault secret holding the certificate content. Required. |
| PFX password | The vault secret for the PFX private key. Only used, and only needed, when the type is PFX. |
| Certificate store | Where it lands: Trusted Root CAs, Intermediate CAs, Personal, or Trusted Publishers. |
Good to know
- Clear failures. If the configured certificate can't be installed, for example a PFX was uploaded but the type was left as public certificate, the step reports a plain-language message telling you it's a problem with the certificate you configured, not the device, so you know exactly what to fix.
- If installation fails, the setup stops by default.
A certificate and a PFX are genuinely different things
A public certificate carries no private key. A PFX bundles an encrypted private key that needs its own password to unlock, which is why the PFX password is a separate field and why picking the wrong type is the most common misconfiguration here.
Part of the step catalogue.
Related
Install Windows 11
True bare-metal Windows 11 install with the right OEM driver pack injected automatically. Wipes the target disk; runs only on the USB entry point.
OOBE configuration
Auto-answer the out-of-box screens (region, keyboard, device name, EULA, optional Wi-Fi) and optionally skip the account screen so the device lands ready, with no duplicate admin.
Language & region
Set the display language, keyboard layout, regional format, home location and timezone for the installed Windows and every new user. Autopilot-compatible.