fix: Add certutil fallback for non-exportable certificate private keys

- Export-PfxCertificate fails with 'Cannot export non-exportable private key' error on some certificates
- Windows certutil.exe can successfully export these certificates where PowerShell cmdlets fail
- Added automatic fallback: when Export-PfxCertificate fails, script attempts export using certutil.exe
- Certutil fallback preserves PFX password protection using -p parameter
- Script reports status as 'Exported (via certutil)' when fallback method is used
- Resolves issue where valid certificates with non-exportable flags could not be distributed

Testing verified:
- PowerShell method used first (preferred when available)
- Certutil fallback triggers only on 'non-exportable' errors
- Both methods preserve password protection
- Certificate file successfully created and accessible

Author: J-MaFf

Scripts/SFA/Export-UserCertificates.ps1

@@ -332,10 +332,10 @@ $exportScriptBlock = {
 
                 try {
                     if ($certPassword) {
-                        Export-PfxCertificate -Cert $cert -FilePath $filePath -Password $certPassword -Force | Out-Null
+                        Export-PfxCertificate -Cert $cert -FilePath $filePath -Password $certPassword -Force -ErrorAction Stop | Out-Null
                     }
                     else {
-                        Export-PfxCertificate -Cert $cert -FilePath $filePath -Force | Out-Null
+                        Export-PfxCertificate -Cert $cert -FilePath $filePath -Force -ErrorAction Stop | Out-Null
                     }
 
                     $results += @{
@@ -350,13 +350,53 @@ $exportScriptBlock = {
                     }
                 }
                 catch {
-                    $results += @{
-                        User         = $userName
-                        Username     = $domainUsername
-                        Store        = $storeType
-                        Status       = "❌ Error: $_"
-                        UsedFallback = $usedFallback
-                        Count        = 0
+                    # If PowerShell export fails with non-exportable error, try certutil as fallback
+                    if ($_ -like "*non-exportable*") {
+                        Write-Host "  ⚠️  PowerShell export failed, trying certutil.exe..." -ForegroundColor Yellow
+
+                        try {
+                            # Convert SecureString password to plain text for certutil
+                            $plaintextPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToCoTaskMemUnicode($certPassword))
+
+                            # Export using certutil with password protection
+                            & certutil.exe -p $plaintextPassword -exportPFX -user My $cert.Thumbprint $filePath | Out-Null
+
+                            if (Test-Path $filePath -ErrorAction SilentlyContinue) {
+                                $results += @{
+                                    User         = $userName
+                                    Username     = $domainUsername
+                                    Store        = $storeType
+                                    Status       = '✅ Exported (via certutil)'
+                                    FileName     = $fileName
+                                    Expiration   = $expirationDate
+                                    UsedFallback = $usedFallback
+                                    Count        = 1
+                                }
+                            }
+                            else {
+                                throw "Certutil export file not created"
+                            }
+                        }
+                        catch {
+                            $results += @{
+                                User         = $userName
+                                Username     = $domainUsername
+                                Store        = $storeType
+                                Status       = "❌ Error (both methods failed): $_"
+                                UsedFallback = $usedFallback
+                                Count        = 0
+                            }
+                        }
+                    }
+                    else {
+                        $results += @{
+                            User         = $userName
+                            Username     = $domainUsername
+                            Store        = $storeType
+                            Status       = "❌ Error: $_"
+                            UsedFallback = $usedFallback
+                            Count        = 0
+                        }
                     }
                 }
             }