How to push ".p12" keypairs into a windows domain's accounts

I assume the reason for distribution via script is the protection by password, which needs to be delivered for the ingestion of the ".p12" into the trust store of the users firefox, which in turn is protected by the individual master password of the users... But then... then the script should not work as well... I do not understand the process, obviously. Has anybody an explanation?

The scriplet i'm told to use:

certutil -f -user -p "YourExportPasswordHere" -importpfx "MyPersonalStore" "\\server\share\certs\machine-identity.p12"

This seems to discuss the same issue: https://github.com/mozilla/policy-templates/issues/335

This was an implementation decision at the time. P12 files typically have other requirements (passwords) that make them not work via policy.

It also would need to show the primary password dialog if a user had one.

I think the key distinction here is between CA certificates and client certificates. Firefox’s Certificates > Install policy is intended for CA certificates and supports DER/PEM, not importing a .p12 bundle containing a user’s private key.

For mTLS, I would avoid distributing the same .p12 private key to every user. Ideally, each user/device should have its own client certificate and private key, preferably issued through your enterprise PKI/MDM or another certificate-enrollment mechanism.

On Windows, GPO can distribute certificates through Public Key Policies, but that is primarily useful for establishing trust and managing certificates in the Windows certificate store. Firefox can then be configured with ImportEnterpriseRoots to trust certificates from the Windows certificate store.

So for your setup, I’d use GPO/PKI for certificate enrollment and trust, rather than trying to place a .p12 file directly into Firefox’s certificate policy. If the private key absolutely must be provisioned, a controlled deployment script or certificate-management/MDM solution would be the safer approach.