Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In the Windows certificate store, I am looking for a way (if it is possible) to store a public/private pair and keep the private exportable, BUT restrict the export to only those that know a password.

The only thing I've seen is that if I make the key exportable, EVERYONE who has access to my user account can export and place a password on the PFX file, but that is not what I want. I want that the export of the private key will be restricted to those that know a specific password.

Is it even possible?

share|improve this question
What you want is not possible. –  Ramhound Jun 3 '13 at 14:08
The password that protects the certificates in the certificate store is the user's account password. What is the use case behind your question? –  Werner Henze Jun 3 '13 at 14:24
@WernerHenze - that is all I wanted to know. Thanks! :-) You can write it as an answer and I'll mark it. –  TCS Jun 3 '13 at 14:56

2 Answers 2

up vote 0 down vote accepted

The password that protects the certificate store and thus all certificates in the certificate store is the user's account password. If you can log into Windows, then you can access your own certificate store and of course also your own private keys. There is no extra password you can set on individual certificates in the certificate store.

share|improve this answer
Just what I wanted to know! Thanks :-) –  TCS Jun 3 '13 at 15:55

The Certificate Import Wizard (that gets called when you install the certificate with the private key) offers an option called “strong private key protection”.

Strong protection option for the import wizard

If it is selected, then after the import an additional Dialogue will allow you to adjust the CryptoAPI security level. When you set it to high, windows will query for an additional password, which is required for every use of the key.

CryptoAPI security level

That Password will be required during the export as well. Strong protection password gets queried during certificate export.

See also grawity's Answer to Question 298344, I took the liberty to snatch the screen-shots from there. Last screen-shot in German -- sorry, I have no English version available

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.