UWP证书在私有Azure Pipeline代理池导入失败，报网络密码错误

问题背景 #

使用以下PowerShell脚本在Azure Pipelines流水线中导入PFX证书时，公共代理运行正常，但Windows 10 VM搭建的私有代理池报Exception calling "Import" with "3" argument(s): "The specified network password is not correct."错误：

param($PfxFilePath, $Password)

$absolutePfxFilePath = Resolve-Path -Path $PfxFilePath
Write-Output "Importing store certificate '$absolutePfxFilePath'..."

Add-Type -AssemblyName System.Security
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cert.Import($absolutePfxFilePath, $Password, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]"PersistKeySet")
$store = new-object system.security.cryptography.X509Certificates.X509Store -argumentlist "MY", CurrentUser
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::"ReadWrite")
$store.Add($cert)
$store.Close()

核心原因 #

公共代理与私有代理的账户权限模型和Windows安全配置存在差异：

• 公共代理使用预配置的高权限运行环境，默认兼容用户级证书存储操作
• Windows 10私有代理的运行账户（通常为NT SERVICE\vstsagent或本地用户）可能缺少对CurrentUser证书存储的写入权限，且默认的PersistKeySet标志无法适配Windows 10的密钥容器安全规则

解决方案 #

方案1：使用PowerShell内置Import-PfxCertificate cmdlet（推荐） #

该cmdlet是微软官方提供的证书导入工具，自动适配不同Windows环境的权限规则，比直接调用.NET方法更可靠：

param($PfxFilePath, $Password)

$absolutePfxFilePath = Resolve-Path -Path $PfxFilePath
Write-Output "Importing store certificate '$absolutePfxFilePath'..."

# 将明文密码转换为安全字符串
$securePassword = ConvertTo-SecureString $Password -AsPlainText -Force
# 导入证书到CurrentUser的个人存储
Import-PfxCertificate -FilePath $absolutePfxFilePath -CertStoreLocation Cert:\CurrentUser\My -Password $securePassword -Exportable

方案2：调整.NET调用的密钥存储标志 #

如果必须保留原脚本结构，需扩展X509KeyStorageFlags参数，添加机器级存储和可导出权限：

param($PfxFilePath, $Password)

$absolutePfxFilePath = Resolve-Path -Path $PfxFilePath
Write-Output "Importing store certificate '$absolutePfxFilePath'..."

Add-Type -AssemblyName System.Security
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2

# 组合密钥存储标志：持久化密钥集 + 机器级容器 + 允许导出
$keyStorageFlags = [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet `
    -bor [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::MachineKeySet `
    -bor [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable

$cert.Import($absolutePfxFilePath, $Password, $keyStorageFlags)
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store -ArgumentList "MY", CurrentUser
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$store.Add($cert)
$store.Close()

方案3：切换证书存储到机器级（LocalMachine） #

如果私有代理以服务账户运行，导入到LocalMachine存储可避免用户级权限限制：

param($PfxFilePath, $Password)

$absolutePfxFilePath = Resolve-Path -Path $PfxFilePath
Write-Output "Importing store certificate '$absolutePfxFilePath'..."

$securePassword = ConvertTo-SecureString $Password -AsPlainText -Force
# 导入到LocalMachine的个人存储
Import-PfxCertificate -FilePath $absolutePfxFilePath -CertStoreLocation Cert:\LocalMachine\My -Password $securePassword -Exportable

额外验证步骤 #

1. 在私有代理VM上手动导入PFX证书，确认密码正确性，排除文件损坏可能
2. 检查Azure Pipelines代理的运行账户：若以服务运行，确保账户有证书存储的读写权限
3. 若使用自签名证书，确认私有代理已信任该证书的根CA

内容的提问来源于stack exchange，提问作者Sena