17

I'm in the process of trying to change the KeySpec property of a code signing certificate from Comodo by following this guide. The guide mentions importing your certificate file into MMC and then exporting it again later. However, I don't seem to have the option to export as a PFX file. I already have a PFX file; I can import it successfully, but when I go to export the option is greyed out / disabled.

pfx disabled

What do I need to do to enable this export option?

29
+50

The Certificates snap-in really doesn't like to export PFX certificates, but PowerShell is happy to. You can use the Export-PfxCertificate cmdlet.

  1. Go to the certificates pseudo-drive by typing cd cert:\ at the PowerShell prompt.
  2. Type cd CurrentUser or cd LocalMachine as appropriate for where the certificate is. You may need to launch PowerShell as admin to export a machine certificate.
  3. cd into the appropriate store (a dir may help). The Personal store in MMC is called My here.
  4. Use dir to identify which ID corresponds to the certificate you want.
  5. Type this command to export it as a PFX with a password:

    Export-PfxCertificate -Cert .\LONGSTRINGOFHEX -FilePath 'C:\path\to\outfile.pfx' -Password (ConvertTo-SecureString -String 'password' -AsPlainText -Force)
    

    LONGSTRINGOFHEX should be replaced with your certificate's ID. Fortunately, you can use tab completion on that.

Once that command executes, you have a PFX certificate protected with the password you supplied. PowerShell refuses to export the certificate's private key without a password, and the password can't be blank. Nevertheless, your PFX is out.

  • Please forgive such an ignorant question, but how do I install the cmdlet? Currently when I type cert: in PS I get "The term 'cert:' is not recognized as the name of a cmdlet, function, script file, or operable program." Windows 10 of course. – soapergem Jul 11 '16 at 19:55
  • @SoaperGEM My apologies, it should be cd cert:\ instead. – Ben N Jul 11 '16 at 20:04
  • 1
    @SoaperGEM This cmdlet is available in Windows 8, 8.1, 10, Server 2012 and Server 2012 R2. Judging by your screenshot, you are set. Also, when importing your certificate, look for a checkbox that allows you to mark the private key as exportable. That should give you the ability to export it via MMC. – user477799 Jul 13 '16 at 8:00
  • 1
    I am getting error - Cannot export non-exportable private key. Can anyone help identify the issue. – Raja Dorji Dec 3 '18 at 15:33
  • 1
    @RajaDorji If a private key was marked as non-exportable, the system generally refuses to export. Tools like Mimikatz (mentioned here) can get around this through unofficial methods. – Ben N Dec 4 '18 at 3:42
0

If you import a cert into the WebHosting store, you can't export the private key. Move it to Personal store, and you will be able to export as PFX. I was able to do this in Windows 2012R2 without having to go to the command line and use Export-PfxCertificate (which is a pain as I couldn't figure out the certificate's ID to save my life).

  • Okay, I'm wrong. Just got lucky. I had to try this task again (reissued a cert), and this method does not work anymore :( – MC9000 Jul 31 '19 at 1:49
  • You can find the Certificate's ID by either going to IIS > Machine > Server Certificates or by cd cert:\LocalMachine\My then 'dir' – Devin Gleason Lambert Oct 28 '19 at 13:06
-1

Export the .P7B file once. And then go back and try exporting the certificate again. The .PFX export get enabled the next time.

  • That certainly does not work! – MC9000 Jul 30 '19 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.