<div class="content" name="ImportCertificate" uuid="ed01d4b2-b77f-496e-8fb1-8f9a0432c592"><p>The ImportCertificate method imports a <span><a href="c6451297-197d-4b4b-b786-3f3187b67b8f#gt_7a0f4b71-23ba-434f-b781-28053ed64879" data-linktype="relative-path">certificate</a></span>
into the <span><a href="c6451297-197d-4b4b-b786-3f3187b67b8f#gt_c925d5d7-a442-4ba4-9586-5f94ccec847a" data-linktype="relative-path">CA</a></span> database.</p><dl>
<dd>
<div><pre> HRESULT ImportCertificate(
   [in, string, unique] wchar_t const* pwszAuthority,
   [in, ref] CERTTRANSBLOB* pctbCertificate,
   [in] LONG dwFlags,
   [out] LONG* pdwRequestId
 );
</pre></div>
</dd></dl><p><b>pwszAuthority: </b>See the <i>pwszAuthority</i>
definition in section <span><a href="faae1099-4b4f-463c-95b0-5962c9bf400e" data-linktype="relative-path">3.1.4.1.1</a></span>. </p><p><b>pctbCertificate: </b>A <span><a href="a94fb0b1-902f-43ea-9422-f2d24bcb10b6" data-linktype="relative-path">CERTTRANSBLOB</a></span> that
contains an ASN.1 DER–encoded (as specified in <span><a href="https://go.microsoft.com/fwlink/?LinkId=90592" data-linktype="external">[X660]</a></span> and <span><a href="https://go.microsoft.com/fwlink/?LinkId=90593" data-linktype="external">[X690]</a></span>)
certificate that is inserted into the CA database.</p><p><b>dwFlags: </b>A <span><a href="../ms-dtyp/29d44d70-382f-4998-9d76-8a1fe93e445c" data-linktype="relative-path">LONG</a></span>
value that MUST take one of the following values.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0</td>
  <td>If this value is set, the CA server does not allow certificates that are not issued by it to be imported into its database.</td>
 </tr><tr>
  <td>FLAG_ALLOW_IMPORT_FOREIGN 0x00010000</td>
  <td>A request to the CA server to allow certificates that are not issued by it to be imported into its database.</td>
 </tr><tr>
  <td>ICF_EXISTINGROW 0x00020000</td>
  <td>A request to the CA to associate the imported certificates with an existing request row.</td>
 </tr></tbody></table>
</dd></dl><p><b>pdwRequestId: </b>Returns the request ID for the
imported certificate. This is used to refer to the certificate after it is
imported into the database. </p><p>ImportCertificate imports a certificate into the CA database
Request table.</p><p>The CA server MUST apply the following processing rules:</p><ol><li><p><span>    </span>If <b>Config_CRLPartition_Enabled</b>
is set to TRUE, CA MUST return E_NOTIMPL error.</p>
</li><li><p><span>    </span>The CA server
MUST enforce that the <i>pctbCertificate</i> parameter value represents an
ASN.1 DER–encoded certificate (as specified in [X660]). If not, it MUST fail
with the error ERROR_INVALID_DATA (0x8007000D). </p>
</li><li><p><span>    </span>The CA server
MUST validate the signature on the certificate by using the <span><a href="c6451297-197d-4b4b-b786-3f3187b67b8f#gt_4cf96ca0-e3a9-4165-8d1a-a21b1397007a" data-linktype="relative-path">public
key</a></span> that is associated with the CA&#39;s <span><a href="c6451297-197d-4b4b-b786-3f3187b67b8f#gt_6a2366ee-fc9c-4406-963d-eac335ed8fc5" data-linktype="relative-path">signing certificates</a></span>.</p>
</li><li><p><span>    </span>If the
ICF_EXISTINGROW flag is not passed as the value of <i>dwFlags</i>, if the
signature validation succeeds (at step 2), and if the certificate does not
already exist in the Request table (this is checked by searching on the
Serial_Number in the certificate in the database), the certificate MUST be
added to the Request table as a new row and the CA MUST return the resulting
Request_Request_ID to the client. For processing rules for each data element in
the Request table, see the ImportCertificate data element in the following
table.</p>
</li><li><p><span>    </span>If the
ICF_EXISTINGROW flag is not passed as the value of <i>dwFlags</i>, if the
signature validation succeeds (at step 2), and if the certificate is already
present in the Request table, the CA MUST fail with the error
ERROR_OBJECT_EXISTS.</p>
</li><li><p><span>    </span>If the
ICF_EXISTINGROW flag is passed as the value of <i>dwFlags</i>, if the signature
validation succeeds (at step 2), and if the certificate does not already exist
in the Request table (this is checked by searching on the Serial_Number in the
certificate in the database):</p>
<p>The CA MUST locate an entry in the
Request table whose Request_Disposition is &#34;request pending&#34; and
whose Request_ID has an entry in the Extensions table with a Subject Key
Identifier equal to the SubjectKeyIdentifier extension of the certificate that
is passed as pctbCertificate.</p>
<ol><li><p><span>   
</span>If the entry is found in the Request Table, the CA MUST update the
fields from the information in the certificate. For processing rules for each
data element in the Request table, see the ImportCertificate processing rules
in the following table. The CA MUST return the Request_Request_ID of the
updated Request table row as the <i>pdwRequestId</i> parameter.</p>
</li><li><p><span>   
</span>If the entry is not found in the Request table, the CA MUST fail with
the error 0x80092009 (CRYPT_E_NO_MATCH).</p>
</li></ol></li><li><p><span>    </span>If the signature
validation fails (at step 2) and FLAG_ALLOW_IMPORT_FOREIGN is not passed as a
value of <i>dwFlags</i>, the CA MUST fail with the error 0x800b0107, according
to the ImportCertificate data element processing rules in the following table.</p>
</li><li><p><span>    </span>If the signature
validation fails (at step 2) and FLAG_ALLOW_IMPORT_FOREIGN is passed as value
of <i>dwFlags</i> and the certificate is already present in the Request table,
the CA SHOULD return the resulting Request_Request_ID to the client. For
processing rules for each data element in the Request table, see the
ImportCertificate processing rules in the following table.<a id="Appendix_A_Target_71"></a><a aria-label="Product behavior note 71" href="5f06c74c-1a29-4fdf-b8dd-ae3300d1b90d#Appendix_A_71" data-linktype="relative-path">&lt;71&gt;</a></p>
</li><li><p><span>    </span>If the signature
validation fails (at step 2), if FLAG_ALLOW_IMPORT_FOREIGN is passed as the
value of <i>dwFlags</i>, and if the certificate is not already present in the
Request table, the certificate SHOULD be added to the Request table as a new
row and the CA SHOULD return the resulting Request_Request_ID to the client.
For processing rules for each data element in the Request table, see the
ImportCertificate data element in the following table.<a id="Appendix_A_Target_72"></a><a aria-label="Product behavior note 72" href="5f06c74c-1a29-4fdf-b8dd-ae3300d1b90d#Appendix_A_72" data-linktype="relative-path">&lt;72&gt;</a></p>
</li></ol><p>The certificate fields and extensions SHOULD be processed
and stored in individual Request table fields according to the rules in the
following table.</p><table><thead>
  <tr>
   <th>
   <p>Data type</p>
   </th>
   <th>
   <p>Maximum
   size of data</p>
   </th>
   <th>
   <p>Data
   element name</p>
   </th>
   <th>
   <p>Processing
   rule or x.509 certificate field or extension</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x10001 long indexed</td>
  <td>4 bytes</td>
  <td>Request_Request_ID</td>
  <td>The next sequential number after Request_Request_ID of the last database row.</td>
 </tr><tr>
  <td>0x1 long</td>
  <td>4 bytes</td>
  <td>&#34;Request_Status_Code&#34;</td>
  <td>If the import is successful, the CA SHOULD set this value to 0.</td>
 </tr><tr>
  <td>0x10001 long indexed</td>
  <td>4 bytes</td>
  <td>&#34;Request_Disposition&#34;</td>
  <td>If the certificate being imported was issued by a foreign CA, set Request_Disposition to &#34;foreign certificate&#34;. The Microsoft CA uses a DB_DISP_FOREIGN value that is equal to decimal 12 for &#34;foreign certificate&#34;. Otherwise, set to &#34;certificate issued&#34;.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_Disposition_Message&#34;</td>
  <td>The CA SHOULD set the value of the Request_Disposition_Message column to any value the implementer considers informative for presentation to a human. The Microsoft CA sets Request_Disposition_Message in this case to &#34;certificate issued&#34;.</td>
 </tr><tr>
  <td>0x10002 date indexed</td>
  <td>8 bytes</td>
  <td>&#34;Request_Submitted_When&#34;</td>
  <td>The time when the method is invoked.</td>
 </tr><tr>
  <td>0x10002 date indexed</td>
  <td>8 bytes</td>
  <td>&#34;Request_Resolved_When&#34;</td>
  <td>The time when the method is invoked.</td>
 </tr><tr>
  <td>0x10004 string indexed</td>
  <td>2048 bytes</td>
  <td>&#34;Request_Requester_Name&#34;</td>
  <td>The identity of the caller invoking the method.</td>
 </tr><tr>
  <td>0x10004 string indexed</td>
  <td>2048 bytes</td>
  <td>&#34;Request_Caller_Name&#34;</td>
  <td>The identity of the caller invoking the method.</td>
 </tr><tr>
  <td>0x3 bin</td>
  <td>4096 bytes</td>
  <td>&#34;Request_Raw_Name&#34;</td>
  <td>The raw subject information from the certificate.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_Country&#34;</td>
  <td>The country attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_Organization&#34;</td>
  <td>The organization attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_Org_Unit&#34;</td>
  <td>The organizational-unit attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_Common_Name&#34;</td>
  <td>The common name attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_Locality&#34;</td>
  <td>The locality attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_State&#34;</td>
  <td>The state or province name attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_Title&#34;</td>
  <td>The title attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_Given_Name&#34;</td>
  <td>The given name attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_Initials&#34;</td>
  <td>The initials attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_SurName&#34;</td>
  <td>The surname attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_Domain_Component&#34;</td>
  <td>The domainComponent attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_EMail&#34;</td>
  <td>The [RFC822] Name from Subject Alternative Name.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Request_Device_Serial_Number&#34;</td>
  <td>The serial number attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x10001 long indexed</td>
  <td>4 bytes</td>
  <td>&#34;Request_ID&#34;</td>
  <td>The next sequential number after Request_Request_ID of the last database row.</td>
 </tr><tr>
  <td>0x3 bin</td>
  <td>16384 bytes</td>
  <td>&#34;Raw_Certificate&#34;</td>
  <td>The byte stream that is pointed to in the parameter pctbCertificate -&gt;pb member.</td>
 </tr><tr>
  <td>0x10004 string indexed</td>
  <td>128 bytes</td>
  <td>&#34;Certificate_Hash&#34;</td>
  <td>The SHA-1 hash over the value of &#34;Raw_Certificate&#34;.</td>
 </tr><tr>
  <td>0x10004 string indexed</td>
  <td>254 bytes</td>
  <td>&#34;Certificate_Template&#34;</td>
  <td>The extnValue of extension with OID (1) 1.3.6.1.4.1.311.20.2.</td>
 </tr><tr>
  <td>0x10004 string indexed</td>
  <td>128 bytes</td>
  <td>&#34;Serial_Number&#34;</td>
  <td>The serial number ([RFC3280] section 4.1.2.2) of the certificate.</td>
 </tr><tr>
  <td>0x2 date</td>
  <td>8 bytes</td>
  <td>&#34;Not_Before&#34;</td>
  <td>The Validity::notBefore ([RFC3280] section 4.1.2.5) field of the certificate.</td>
 </tr><tr>
  <td>0x10002 date indexed</td>
  <td>8 bytes</td>
  <td>&#34;Not_After&#34;</td>
  <td>The Validity::notAfter ([RFC3280] section 4.1.2.5) field of the certificate.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>128 bytes</td>
  <td>&#34;Subject_Key_Identifier&#34;</td>
  <td>The Value of the SubjectKeyIdentifier ([RFC3280] section 4.2.1.2) extension of the certificate.</td>
 </tr><tr>
  <td>0x3 bin</td>
  <td>4096 bytes</td>
  <td>&#34;Raw_Public_Key&#34;</td>
  <td>The raw value of the public key that is associated with the certificate. (SubjectPublicKeyInfo-&gt;subjectPublicKey).</td>
 </tr><tr>
  <td>0x1 long</td>
  <td>4 bytes</td>
  <td>&#34;Public_Key_Length&#34;</td>
  <td>The length, in bits, of the public key that is associated with the certificate (SubjectPublicKeyInfo-&gt;subjectPublicKey).</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>254 bytes</td>
  <td>&#34;Public_Key_Algorithm&#34;</td>
  <td>The name of the algorithm that is associated with the public key of the certificate (SubjectPublicKeyInfo-&gt;algorithm-&gt;algorithm).</td>
 </tr><tr>
  <td>0x3 bin</td>
  <td>4096 bytes</td>
  <td>&#34;Raw_Public_Key_Algorithm_Parameters&#34;</td>
  <td>The raw value of the parameters that are associated with the public key of the certificate (SubjectPublicKeyInfo-&gt;algorithm-&gt;parameters).</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Distinguished_Name&#34;</td>
  <td>The Subject ([RFC3280] section 4.1.2.6) field of the certificate.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Country&#34;</td>
  <td>The country attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Organization&#34;</td>
  <td>The organization attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;OrgUnit&#34;</td>
  <td>The organizational-unit attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x10004 string indexed</td>
  <td>8192 bytes</td>
  <td>&#34;Common_Name&#34;</td>
  <td>The common name (CN) attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Locality&#34;</td>
  <td>The locality attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;State&#34;</td>
  <td>The state or province name attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Title&#34;</td>
  <td>The title attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Given_Name&#34;</td>
  <td>The given name attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Initials&#34;</td>
  <td>The initials attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;SurName&#34;</td>
  <td>The surname attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Domain_Component&#34;</td>
  <td>The DomainComponent attribute of the certificate Subject.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;EMail&#34;</td>
  <td>The [RFC822] Name from Subject Alternative Name.</td>
 </tr><tr>
  <td>0x4 string</td>
  <td>8192 bytes</td>
  <td>&#34;Device_Serial_Number&#34;</td>
  <td>The serial number attribute of the certificate Subject.</td>
 </tr></tbody></table><p> </p></div>