How To: Export an Installed Certificate and Its Private Key as a PFX File

Version Affected: All

 

Overview

This article covers exporting a certificate and its private key from the Windows Certificate Store as a single PFX (.pfx) file, for example to move the SecureAuth appliance certificate to another server. To combine a certificate and private key that already exist as two separate files into a PFX instead, see How To: Merge Separate Certificate and Private Key Files into a PFX.

Export the Certificate Using the Certificates Console

1. On the server, search for and open Certificates Console. If a warning prompt appears, click Yes.

2. Expand Personal > Certificates, and find the certificate to export — for example, the appliance's localhost certificate. Right-click it and choose All Tasks > Export...

3. In the Certificate Export Wizard, click Next.
4. Select Yes, export the private key and click Next.

5. On the Export File Format page, confirm Personal Information Exchange - PKCS #12 (.PFX) is selected, along with Include all certificates in the certification path if possible, Export all extended properties, and Enable certificate privacy. Click Next.

6. On the Security page, check Password, then enter and confirm a password — a password is required because the private key is included. Click Next.

7. Click Browse, choose a save location, and give the file a name — the name has no effect on the certificate itself. Click Save, then Next.

8. Review the summary on the final page and click Finish.
9. The exported .pfx file is now in the folder chosen in Step 7.

10. Copy the PFX file to the target server. When importing it there, select Local Machine as the destination certificate store, and check Mark this key as exportable. This will allow you to back up or transport your keys at a later time. if the certificate may need to be exported again later.

Special Considerations

• The exported PFX file contains the certificate's private key — store it and its password with the same care as any other credential.
• Use a password that can be remembered or securely recovered; the same password is required again when the PFX is imported into another certificate store.
• Delete the PFX file from disk once it has been imported into the target certificate store, rather than leaving it in an unsecured location.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.