A PowerShell script to import a certificate authority chain in a very specific order

Import-CAChain.ps1

# Make sure we are running as Admin
If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")){   
    $arguments = "& '" + $myinvocation.mycommand.definition + "'"
    Start-Process powershell -Verb runAs -ArgumentList $arguments
    Break
    }

# # # #

$Tab = [char]9

# # # #

## Creating X509Certificate2 objects

$root_exp2019_base64 = @"
MIIDpDCCAoygAwIBAgIESqfCbTANBgkqhkiG9w0BAQUFADByMQswCQYDVQQGEwJV
UzEQMA4GA1UEChMHRW50cnVzdDEiMCAGA1UECxMZQ2VydGlmaWNhdGlvbiBBdXRo
b3JpdGllczEtMCsGA1UECxMkRW50cnVzdCBNYW5hZ2VkIFNlcnZpY2VzIE5GSSBS
b290IENBMB4XDTA5MDkwOTE0Mjc1MVoXDTE5MDkwOTE0NTc1MVowcjELMAkGA1UE
BhMCVVMxEDAOBgNVBAoTB0VudHJ1c3QxIjAgBgNVBAsTGUNlcnRpZmljYXRpb24g
QXV0aG9yaXRpZXMxLTArBgNVBAsTJEVudHJ1c3QgTWFuYWdlZCBTZXJ2aWNlcyBO
RkkgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJH4tAu
DqD0qodxVB1Cd4VV7yPCt+gYZx3iAZ2gug7e5kxagxj7mR7TtgsnIz4/+YuqbENr
QEeCk+LIt+1mcnVrGGjmR7l5kcVOu3QADKyYgHgXyyBBbs3jipyTKWL5ThcJR6cr
YdqsAxZS4GYofWHCxx7ccYBUZ2uanpQ34P3HAdzQ/wiZi5OpMCoY8X+BNbLriidO
XAytEa5jeWYHEf5p0gqn4hDDqeEMfTVnmyfr0KrCsNAfqg6EJ6PiH6lccHJLHaYX
1OeRBGldZZeW8GsKuQ6LDpHFxrC4kY+X9sBTSKWuTq6COwXP+12gm2oT+kFiFGQO
IZRPYqc47zEw0ykCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
MAMBAf8wHQYDVR0OBBYEFBp0VR6KhQifUF0+ikYBioGc+Z4eMA0GCSqGSIb3DQEB
BQUAA4IBAQAwbuFF48MXnzv5Wkjn8WrvH0I8s0lGHE3nWTDMIBjKA0wqHkPAdvp9
4uVyndZcOmz5AAI3Xpusv5NwUvcIEBUS8/A0fZmJOErb/A7r2PuvccEzZLdx1pOu
RcaKo/JxJSidKqa8zVf73finWTyxI3lgyE+3BiShrhkejMKzPD3culTPnw8fuCq8
+J3v6cmwOEFIjwdMEuLOGY7Fung2QnRzgAKeQ9rD1HB87HSM9lMcHwkZ/qLB9uDn
bNzszTJtjlh1GMKVh3MCmDColAO14pgblRZBU2qC/LIjXxwHWbuCzl6dU/LEjI8O
yDA8vC1Os+yoB7sywcW4xLrV/HQi9TDv
"@
$root_exp2019 = [security.cryptography.x509certificates.x509certificate2]([System.Convert]::FromBase64String($root_exp2019_base64))

$intermediate_exp2019_base64 = @"
MIIHNjCCBh6gAwIBAgIESqf3GTANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJV
UzEQMA4GA1UEChMHRW50cnVzdDEiMCAGA1UECxMZQ2VydGlmaWNhdGlvbiBBdXRo
b3JpdGllczEtMCsGA1UECxMkRW50cnVzdCBNYW5hZ2VkIFNlcnZpY2VzIE5GSSBS
b290IENBMB4XDTExMDUyMzIyMjIyM1oXDTE5MDgyMzIyNTIyM1owcTELMAkGA1UE
BhMCVVMxEDAOBgNVBAoTB0VudHJ1c3QxIjAgBgNVBAsTGUNlcnRpZmljYXRpb24g
QXV0aG9yaXRpZXMxLDAqBgNVBAsTI0VudHJ1c3QgTkZJIE1lZGl1bSBBc3N1cmFu
Y2UgU1NQIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4einY5wW
onUXmCm1+RKM26NsmKIOeL7W9ovQpk057yWIclUWQ5cyVjblz9g/sXHtagFekrTi
Swl45RSMLv5JvlUPs+D5fn/v7is6yv/90rP6tlKByWcHQ3mYssNt8UBvXr7bI9UG
Pgox2kjAgS8AheLEHJFhq6xvCZ4GFp5QBG795O6N381dA98ksJ6EWKn7NBeB4tnY
m5PPKNWOOVWQUsnviYDy/8nujMz8Qx1mkSRWLrAU7pviVbZFwzOXntb7j3qm0y9J
yPjOKLpHuCQuZe7FsghDqxQWeE5yu4fOIx2rC/R3RRD29CpsDEzES1DMjFNsgAAQ
fGp2mf0x0HynmwIDAQABo4ID0zCCA88wDgYDVR0PAQH/BAQDAgEGMIGABgNVHSAE
eTB3MA8GDWCGSAGG+muBSAMKBwEwDwYNYIZIAYb6a4FIAwoHAjAPBg1ghkgBhvpr
gUgDCgcDMA8GDWCGSAGG+muBSAMKBwQwDwYNYIZIAYb6a4FIAwoHBTAPBg1ghkgB
hvprgUgDCgcGMA8GDWCGSAGG+muBSAMKBwkwDwYDVR0TAQH/BAUwAwEB/zCCAVoG
CCsGAQUFBwEBBIIBTDCCAUgwgcMGCCsGAQUFBzAChoG2bGRhcDovL25maXJvb3Rk
aXIubWFuYWdlZC5lbnRydXN0LmNvbS9vdT1FbnRydXN0JTIwTWFuYWdlZCUyMFNl
cnZpY2VzJTIwTkZJJTIwUm9vdCUyMENBLG91PUNlcnRpZmljYXRpb24lMjBBdXRo
b3JpdGllcyxvPUVudHJ1c3QsYz1VUz9jQUNlcnRpZmljYXRlO2JpbmFyeSxjcm9z
c0NlcnRpZmljYXRlUGFpcjtiaW5hcnkwUAYIKwYBBQUHMAKGRGh0dHA6Ly9uZmly
b290d2ViLm1hbmFnZWQuZW50cnVzdC5jb20vQUlBL0NlcnRzSXNzdWVkVG9ORklS
b290Q0EucDdjMC4GCCsGAQUFBzABhiJodHRwOi8vbmZpb2NzcC5tYW5hZ2VkLmVu
dHJ1c3QuY29tMIIBiQYDVR0fBIIBgDCCAXwwgemggeaggeOGOGh0dHA6Ly9uZmly
b290d2ViLm1hbmFnZWQuZW50cnVzdC5jb20vQ1JMcy9ORklSb290Q0EuY3JshoGm
bGRhcDovL25maXJvb3RkaXIubWFuYWdlZC5lbnRydXN0LmNvbS9vdT1FbnRydXN0
JTIwTWFuYWdlZCUyMFNlcnZpY2VzJTIwTkZJJTIwUm9vdCUyMENBLG91PUNlcnRp
ZmljYXRpb24lMjBBdXRob3JpdGllcyxvPUVudHJ1c3QsYz1VUz9jZXJ0aWZpY2F0
ZVJldm9jYXRpb25MaXN0O2JpbmFyeTCBjaCBiqCBh6SBhDCBgTELMAkGA1UEBhMC
VVMxEDAOBgNVBAoTB0VudHJ1c3QxIjAgBgNVBAsTGUNlcnRpZmljYXRpb24gQXV0
aG9yaXRpZXMxLTArBgNVBAsTJEVudHJ1c3QgTWFuYWdlZCBTZXJ2aWNlcyBORkkg
Um9vdCBDQTENMAsGA1UEAxMEQ1JMMTAfBgNVHSMEGDAWgBQadFUeioUIn1BdPopG
AYqBnPmeHjAdBgNVHQ4EFgQUX67OcZNkOG7fdo9fyy02DBQw/7wwDQYJKoZIhvcN
AQELBQADggEBAEc2eFK1HVR6557ny19NhPk9UlJ0oPn0FeJzoOZNhs3dsB25D3Z7
L+SidXR/px0Sss8HBMeMjsjaDoHhRdLnJCKDr76kngrTACDxDNtDFxDvJd6HJfDm
npLwKvRur/LzyiwhmCWRzdRLFZEepj5BUtZHb2OMegpk7cy55FmAMLKY3lb17W5L
4rF/FTX2iSxZXjIMnXm4gVzrukiLtdbL9OAnsYzBG3i5XjjLagu+1VDNYTRE9py3
5+PbDmrRilFroftZJ8f1flUmWaV3I5Co3FSuAt67heDkuNmoXpi3A38Vt8Vs0lDW
AlCtY2RDtiEZLsuGP9O4rclSk3QisniMbls=
"@
$intermediate_exp2019 = [security.cryptography.x509certificates.x509certificate2]([System.Convert]::FromBase64String($intermediate_exp2019_base64))

$root_exp2027_base64 = @"
MIIDpDCCAoygAwIBAgIESqimDTANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJV
UzEQMA4GA1UEChMHRW50cnVzdDEiMCAGA1UECxMZQ2VydGlmaWNhdGlvbiBBdXRo
b3JpdGllczEtMCsGA1UECxMkRW50cnVzdCBNYW5hZ2VkIFNlcnZpY2VzIE5GSSBS
b290IENBMB4XDTE2MTExNjE2MzEwNFoXDTI3MTIxNjE3MDEwNFowcjELMAkGA1UE
BhMCVVMxEDAOBgNVBAoTB0VudHJ1c3QxIjAgBgNVBAsTGUNlcnRpZmljYXRpb24g
QXV0aG9yaXRpZXMxLTArBgNVBAsTJEVudHJ1c3QgTWFuYWdlZCBTZXJ2aWNlcyBO
RkkgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL8fW2c5
Y1H3DBZcF5uwko+I1N9643gEq3PYUU/AtMzRBJ1PFiipWRNyLYPoVaPYr6GUDsrl
TyvQ7LJD5uDOFPxWtGggqcDGFPC8u0MBUvqTvjCMBuGwI55vrjfeW4mZfsoGo+qX
3qHbCRmif/PywciYTnYhArPtM9tZ/9Nyaunpgrk0zKS0G7dgU+aaqW+BQKy8ss6t
1qbcD5HV5laf6nlTXJ0JrMCbUmuUbhNfCp9e+TwS4LtqjPRL5D/pnUkzURyl2F6/
53yZ0M51SJy9hxEnTYHd4QmJp3yR2fDEVI7Ug/6RBgyPSjlnWbuDPDArD+G2yzTs
6tmc1OSDvWYvVUkCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
MAMBAf8wHQYDVR0OBBYEFPrfIwHEquwj461vDTSlDc85ZGVeMA0GCSqGSIb3DQEB
CwUAA4IBAQCc5cuNlP+rF3KHR/UOwlNc6YWLxf2ImQ2Zhv+ULPKczx/pZPELHXnz
kAhTtjpxjpYuH8NHKUxphJEBCL7P7X9zMO66Z5Rso3iwCC95ffYYqJuIxpBn8xuk
Fm3h6sblYlDiMqbQ4wqtNDPMnlvkBbosp2vsr6V5j5jr1Cp/5e6tKuQuCH8iHq8X
5kCvImZEzAf8aAH6pRv3pVswCyxBcPzGHMj4N9RrRFBb462+Sk5q1GMA7roajPpR
Ht7COZNJr2QhWUGSQlavqaaRwYNyeBYuTID8Ihk+VIDdsISQPcor73GMpxK30zym
fDpTdQ0G0+5XayKnMi2NCLO6EPsLvEJJ
"@
$root_exp2027 = [security.cryptography.x509certificates.x509certificate2]([System.Convert]::FromBase64String($root_exp2027_base64))

$intermediate_exp2027_base64 = @"
MIIH6DCCBtCgAwIBAgIESqi56jANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJV
UzEQMA4GA1UEChMHRW50cnVzdDEiMCAGA1UECxMZQ2VydGlmaWNhdGlvbiBBdXRo
b3JpdGllczEtMCsGA1UECxMkRW50cnVzdCBNYW5hZ2VkIFNlcnZpY2VzIE5GSSBS
b290IENBMB4XDTE3MDUxNjE0MzEzNVoXDTI3MTExNjE1MDEzNVowcTELMAkGA1UE
BhMCVVMxEDAOBgNVBAoTB0VudHJ1c3QxIjAgBgNVBAsTGUNlcnRpZmljYXRpb24g
QXV0aG9yaXRpZXMxLDAqBgNVBAsTI0VudHJ1c3QgTkZJIE1lZGl1bSBBc3N1cmFu
Y2UgU1NQIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoOEqao5H
z2toLgtRAaca84ZyEuQ9QVpZ1RdJEHkFZpLnfx396cjx7ZlwUfmeo41l8NVsgZh8
AVnSdZQLU1rT3Lf2j+4vvHDGhtWTGKQM22obX6n/j1nk66JA6U0pANIWnuHQ9APr
10IugCpVIoYfVWXvuj+Jj8NJKehUdDfv1L3SZwW/KE9Osuadjx+y+jZ3d87Y+8r8
rzmKggqNxrE+xBVpRFxYyVMtWcooAG6YyO7Arp3BlufephNWOjzYr3TCCJyjk02F
yxTlf9WqfhDNguAFGhbL97NRZPKpRLcEc6gHI8VBtGdP+BiDx/c8Kn0tTf3I41yB
jMZ6h7I66502sQIDAQABo4IEhTCCBIEwDgYDVR0PAQH/BAQDAgEGMIIBHQYDVR0g
BIIBFDCCARAwDwYNYIZIAYb6a4FIAwoHATAPBg1ghkgBhvprgUgDCgcCMA8GDWCG
SAGG+muBSAMKBwMwDwYNYIZIAYb6a4FIAwoHBDAPBg1ghkgBhvprgUgDCgcFMA8G
DWCGSAGG+muBSAMKBwYwDwYNYIZIAYb6a4FIAwoHBzAPBg1ghkgBhvprgUgDCgcI
MA8GDWCGSAGG+muBSAMKBwkwDwYNYIZIAYb6a4FIAwoHCjAPBg1ghkgBhvprgUgD
CgcLMA8GDWCGSAGG+muBSAMKBwwwDwYNYIZIAYb6a4FIAwoHDTAPBg1ghkgBhvpr
gUgDCgcOMA8GDWCGSAGG+muBSAMKBw8wDwYNYIZIAYb6a4FIAwoHEDASBgNVHRMB
Af8ECDAGAQH/AgEAMIIBWgYIKwYBBQUHAQEEggFMMIIBSDBQBggrBgEFBQcwAoZE
aHR0cDovL25maXJvb3R3ZWIubWFuYWdlZC5lbnRydXN0LmNvbS9BSUEvQ2VydHNJ
c3N1ZWRUb05GSVJvb3RDQS5wN2MwgcMGCCsGAQUFBzAChoG2bGRhcDovL25maXJv
b3RkaXIubWFuYWdlZC5lbnRydXN0LmNvbS9vdT1FbnRydXN0JTIwTWFuYWdlZCUy
MFNlcnZpY2VzJTIwTkZJJTIwUm9vdCUyMENBLG91PUNlcnRpZmljYXRpb24lMjBB
dXRob3JpdGllcyxvPUVudHJ1c3QsYz1VUz9jQUNlcnRpZmljYXRlO2JpbmFyeSxj
cm9zc0NlcnRpZmljYXRlUGFpcjtiaW5hcnkwLgYIKwYBBQUHMAGGImh0dHA6Ly9u
ZmlvY3NwLm1hbmFnZWQuZW50cnVzdC5jb20wggGaBgNVHR8EggGRMIIBjTCB+qCB
96CB9IY5aHR0cDovL25maXJvb3R3ZWIubWFuYWdlZC5lbnRydXN0LmNvbS9DUkxz
L05GSVJvb3RDQTIuY3JshoG2bGRhcDovL25maXJvb3RkaXIubWFuYWdlZC5lbnRy
dXN0LmNvbS9jbj1XaW5Db21iaW5lZDIsb3U9RW50cnVzdCUyME1hbmFnZWQlMjBT
ZXJ2aWNlcyUyME5GSSUyMFJvb3QlMjBDQSxvdT1DZXJ0aWZpY2F0aW9uJTIwQXV0
aG9yaXRpZXMsbz1FbnRydXN0LGM9VVM/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz
dDtiaW5hcnkwgY2ggYqggYekgYQwgYExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdF
bnRydXN0MSIwIAYDVQQLExlDZXJ0aWZpY2F0aW9uIEF1dGhvcml0aWVzMS0wKwYD
VQQLEyRFbnRydXN0IE1hbmFnZWQgU2VydmljZXMgTkZJIFJvb3QgQ0ExDTALBgNV
BAMTBENSTDEwHwYDVR0jBBgwFoAU+t8jAcSq7CPjrW8NNKUNzzlkZV4wHQYDVR0O
BBYEFGb5JZiuy/vhjACEGdSF/5NW6tamMA0GCSqGSIb3DQEBCwUAA4IBAQAYzB20
TFlb/g4Q/l+evqW05L9MxsayCR+sCXxpi4CtYgeAxWGTTLIUbbRj7vWPGC/aanWr
Was8mRYsJSQRy3SGZJ0cG8bkheIe4Tqm6ALmw2DRaaolDKSJ6yQ+LART0C+Oi8IY
k5BcM6hLpQlm/30UYtvA53AiwTMJVClb7QK+e//4Z0wnDD23PdQXWiUQE9q4+vz3
L+ifgFEljY6EqdKT6dlZVl16xt5gZrrdFlsblPZxuvnnmgl88/qwMd2zfcKTIanP
M+llQt6jM2L3C+PTOBALt9XZyq3Qw1RLfQWsaNcs0/fDOoJfHHw0r9QmMLrBpWJp
7pVxA2WkITMFclBt
"@
$intermediate_exp2027 = [security.cryptography.x509certificates.x509certificate2]([System.Convert]::FromBase64String($intermediate_exp2027_base64))

# # # #

## Open Certificate Stores

$rootStore = Get-Item "Cert:\LocalMachine\Root"
$rootStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags] "ReadWrite")
$thirdParty = Get-Item "Cert:\LocalMachine\AuthRoot"
$thirdParty.Open([System.Security.Cryptography.X509Certificates.OpenFlags] "ReadWrite")
$intermediateStore = Get-Item "Cert:\LocalMachine\CA"
$intermediateStore.Open([System.Security.Cryptography.X509Certificates.OpenFlags] "ReadWrite")

# # # #

Write-Host "Removing bad CA chain..."

$CarillonInformationSecurityInc_thumbprint = "a6 9e 03 36 c4 e5 90 23 ff 65 3c 71 f9 28 eb 73 f2 1c 00 f0".Replace(" ","").ToUpper()
$CertiPathBridgeCAG2_thumbprint = "35 de a4 4a 5c 26 31 f2 6b a4 2c 33 0a 3b 1e c6 ad 3b 39 00".Replace(" ","").ToUpper()
$FederalCommonPolicyCA_thumbprint = "90 5f 94 2f d9 f2 8f 67 9b 37 81 80 fd 4f 84 63 47 f6 45 c1".Replace(" ","").ToUpper()
$FederalBridgeCA206_thumbprint = "e5 ae 09 b5 23 7f 70 b2 5e f5 17 38 1d 78 1f a0 06 7f e4 0c".Replace(" ","").ToUpper()

ForEach ($certStore in $intermediateStore, $rootStore, $thirdParty ) {
    $certStoreName = $certStore.PSPath
    Write-Host "$Tab From $certStoreName"
    ForEach ( $certificate in $certStore.Certificates ) { 
        if (( $certificate.Thumbprint -eq $CarillonInformationSecurityInc_thumbprint) -or
            ( $certificate.Thumbprint -eq $CertiPathBridgeCAG2_thumbprint) -or
            ( $certificate.Thumbprint -eq $FederalCommonPolicyCA_thumbprint ) -or
            ( $certificate.Thumbprint -eq $FederalBridgeCA206_thumbprint) -or  
            ( $certificate.Thumbprint -eq $root_exp2027.Thumbprint) -or
            ( $certificate.Thumbprint -eq $intermediate_exp2027.Thumbprint)) {
            $certName = $certificate.SubjectName.Name
            Write-Host "$Tab $Tab Removing $certName"
            $certStore.Remove($certificate)
            }
        }
    }

$thirdParty.close()

# # # #

Write-Host "Adding 2019 CA chain"

$rootStore.Add($root_exp2019)

## Doesn't work in environments with older PowerShell versions
#Out-File -FilePath "root_exp2019.cer" -InputObject $root_exp2019_base64
#Import-Certificate "root_exp2019.cer" -CertStoreLocation "$rootStore"

$intermediateStore.Add($intermediate_exp2019)

## Doesn't work in environments with older PowerShell versions
#Out-File -FilePath "intermediate_exp2019.cer" -InputObject $intermediate_exp2019_base64
#Import-Certificate "intermediate_exp2019.cer" -CertStoreLocation "$intermediateStore"

# # # #

Write-Host "Adding corrected 2027 CA chain"

$rootStore.Add($root_exp2027)

## Doesn't work in environments with older PowerShell versions
#Out-File -FilePath "root_exp2027.cer" -InputObject $root_exp2027_base64
#Import-Certificate "root_exp2027.cer" -CertStoreLocation "$rootStore"

$intermediateStore.Add($intermediate_exp2027)

## Doesn't work in environments with older PowerShell versions
#Out-File -FilePath "intermediate_exp2027.cer" -InputObject $intermediate_exp2027_base64
#Import-Certificate "intermediate_exp2027.cer" -CertStoreLocation "$intermediateStore"

# # # #

$rootStore.Close()
$intermediateStore.Close()

Read-Host "Certificates Installed. Press Enter to Continue..."