PwdProtect-Cert.ps1

$ErrorActionPreference = "Stop"

#Name of pfx file that needs to be password protected with extension
$pfxFileName = Read-Host -Prompt 'Input pfx file name' 

if($pfxFileName) {
    #Replace .\ with actual path where .pfx is stored. Do not include file name
    $pfxFilePath = (Get-Item -Path ".\").FullName  

    $certCollection = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection    
    $certCollection.Import("$pfxFilePath\$pfxFileName", $null,[System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable) 

    $password = Read-Host -Prompt 'Enter password for file' 
    $protectedCertificateBytes = $certCollection.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pkcs12, $password)
    
    # New pfx will be generated at same location where existing pfx is with the following name PW-protect-{same}
    [System.IO.File]::WriteAllBytes("$pfxFilePath\PW-protect-$pfxFileName", $protectedCertificateBytes)
    Write-Host "Operation Completed"
}

#Ref: https://www.powershellbros.com/export-keyvault-certificates-azure/