Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to MS CA and I have recently installed a MS CA setup on a VM. I used the web service provided "" to request a certificate. I approved my test certificate and went back to the web service to retrieve my approved certificate. I noticed that I do not have the private key corresponding to the test ceritifcate I requested and I tried to pry open and search the filesystem on the server for the certificate's private key but found nothing.

Here's my question:

  1. Does the MS CA generate for you a private key when you use the web service to request a new certificate.
  2. If the MS CA does generate for you a private key, where is it located at and how do I retrieve it ?
share|improve this question

migrated from Apr 24 '14 at 11:52

This question came from our site for software developers, mathematicians and others interested in cryptography.

No, of course the MS CA (that is, the Certificate Authority server software in Microsoft Windows Server) doesn't generate a private key for you! That would be a terrible security design!

The MS CA uses special HTML tags (that were originally MS-proprietary but are now widely supported) to tell the client web browser to generate a key pair and to send just the public key to the MS CA. The MS CA uses that public key, plus the identity information the server already knows about the account you used when logging into the MS CA's web UI at the /certsrv URL, to generate a public key certificate for you, and to make that new cert (and the CA certs in the trust chain) available for download.

When your browser sees the special HTML tags and generates the key pair, it stores the private key somewhere locally on the client machine. For MSIE on Windows, that would be in the "Microsoft Certificate Store" (read the word "Store" as "Storage", not "Retail Shop" :). For Safari on the Mac, that would be in the Mac Keychain. Other browsers may choose to use their host OS's built-in features for secure storage of the private key, or they may implement their own way to securely store private keys.

After you download the newly issued cert, you probably need to install it into the same secure storage area that your browser put the matching private key when it generated it. So on the Mac, you'd need to import that cert into the Keychain. I believe MSIE for Windows has an ActiveX control or other browser plug-in or built-in functionality that automatically downloads the public key certificate and installs it into the Microsoft Certificate Store on the client machine.

[Caveat lector: I haven't messed with this stuff on Windows-based systems in years (like the Windows XP and Windows Server 2003 era), so this information may be terribly out of date. Hopefully someone with more recent knowledge of how this works in Windows-based systems can correct me.]

share|improve this answer
Is there a way I can find my generated private key and extract it ? I was digging through my local Certificate Store trying to find my private key. – user318626 Apr 27 '14 at 1:02
Remember to look on the machine where the web browser was running. I seem to recall that you can export the cert and private key together as a PKCS#12 (.p12) encrypted identity file. But perhaps only if the key was marked as exportable when it was created. I've used OpenSSL command-line tools to extract a private key from a .p12 afterwards. – Spiff Apr 27 '14 at 3:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.