7

I am running Windows 10. I have install a certificate to my computer. I see that in my MMC. But when I try to export a pfx file for that certificate. That option is disable.

I was able to successfully export a pfx file for that certificate before on the SAME machine (say machine A). But then when I install the pfx file on another machine (say machine B) with the password that I specified. It did not work. It said password not correct or something like that. So I went back to the certificate machine (machine A), delete the certificate and install the certificate again.

Afterward, I was not longer able to export the pfx file again. Is there a way to fix this?

Can you please tell me how can I fix that?

And when I tried repairstore, I get Object was not found error:

C:\WINDOWS\system32>certutil -repairstore my ‎356000019dba8d5ddd348062b90000000001d
my "Personal"
CertUtil: -repairstore command FAILED: 0x80090011 (-2146893807 NTE_NOT_FOUND)
CertUtil: Object was not found.

enter image description here

Improve this question
4
  • The certificate probably doesn’t have the “Allow private key export” flag set. From what I gather, that means you’re out of luck. Or perhaps you don’t have a private key at all?
    – Daniel B
    Jan 13, 2016 at 7:59
  • I was able to export to pfx file with the same certificate on the same machine before. Then I delete the certificate from the certificate store in my machine. And afterward, I am no longer able to export to pfx file. Can I fix that?
    – n179911
    Jan 13, 2016 at 8:23
  • After deleting the certificate, how did you obtain a new copy? Are you sure you actually have the certificate’s private key?
    – Daniel B
    Jan 13, 2016 at 18:59
  • I have the *.CER file. So I just reinstall the *.CER file.
    – n179911
    Jan 13, 2016 at 19:17

2 Answers 2

Reset to default
3

What you’re seeing is a Windows limitation: It won’t let you use the PKCS12 format when you don’t have the certificate’s private key. Because you only imported a CER file, you don’t have the key.

If you absolutely must have a PKCS12 file containing only the certificate, use the following OpenSSL command:

openssl pkcs12 -export -nokeys -in certificate.cer -out pkcs12.pfx
Improve this answer
2
  • That worked for me, thanks. FWIW it's possible to export from .crt as well which seems to be fundamentally the same thing.
    – basquiatraphaeu
    Apr 26, 2022 at 14:48
  • Also, in case you need to specify your private key, just use something like: openssl pkcs12 -export -out '<output>\<file>.pfx -inkey '<keyname>.key' -in '<certificate>.crt|cer'
    – basquiatraphaeu
    Apr 26, 2022 at 14:58
1

In my instance, the problem was that the computer I was trying to use to generate the PFX was not the same machine that was used to generate the CSR. The big red note at the top of my instruction page stated that it must be the same machine.

Improve this answer
1
  • Thanks a lot. This really helped.
    – Gautam Jain
    Nov 27, 2022 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.