I made the fatal mistake of importing a personal certificate to Firefox which is of course not supported by government institutions even though they say it is.

I'd now like to transfer that certificate to windows certificate store, but that also doesn't want to work:

I go to certificates in Firefor and click on "Backup" button to export .p12. This goes smoothly.

But when I then right click on the generated file and choose the "Install PFX" option, Windows is constantly complaining that I entered the wrong certificate password.

Well, I haven't: I have exported the certificate three times, once even without specifying the password, but Windows always rejected the certificate import stating that my entered password is incorrect.

Any hints on how I could move that certificate to windows store?

I had the same problem. Here's how I fixed it:

Go to https://www.digicert.com/util/ Download the DigiCert SSL Utility. I don't think it matters where you got the original certificate from.

Use that utility to import (upper left corner) the certificate to the Windows Store.

Bonus: I had a problem where the exporting the certificate from Windows would not import into Visual Studio. Make sure to uncheck the "Include all certificates in the certification path if possible". Visual Studio would give an error of "Cannot find the certificate and private key for decryption"

  • Excellent answer. I was already in pain thinking to reinstall firefox 57 – Regis Portalez Apr 18 at 15:54
up vote 2 down vote accepted

Turns out the "problem" was Firefox version: I had 59 (64 bit) while the last "working" is 57. I'm guessing 58 and later versions use a new encryption type, but didn't research to confirm.

I had to do the following:

  • Export (backup) certificate from 59
  • Open 57, import certificate into 57
  • Export certificate from 57
  • (Everything also worked on government institutions sites as well)
  • Import certificate into windows certificate store (the one exported from 57)
  • Uninstall 57 (or use that one for government institutions)
  • FF59 bug report is here - turns out it's related to the number of rounds – Mendhak Apr 4 at 7:57

I found another solution using OpenSSL, which I already had installed. The trick was to convert to a .pem file only outputting client certificates, and then back to a .p12 file.

openssl pkcs12 -clcerts -in certificate.p12 -out certificate.pem
openssl pkcs12 -in certificate.pem -out certificate_win.p12

The answer by Robert about removing certificates in the certification path got me looking in the right direction, along with this page: https://blog.pki.dfn.de/2018/03/firefox-59-windows-und-probleme-mit-dem-zertifikatexport/

  • I solved problem on win with openssl. Slightly different commands: – dbricman Apr 9 at 12:42

I solved problem on win with openssl (0.9.8). Slightly different commands like aswer of "outoftheway". That commands did not work for me, these are:

openssl.exe pkcs12 -in old_certificate.p12 -out cert.pem -nodes
openssl.exe pkcs12 -export -in cert.pem -out new_certificate.pfx

This is due to a bug in Firefox version < 60. Updating to version 60 exports the certificate correctly so you can import it into windows certificate store. I experienced this with Firefox version 59. After updating to Firefox version 60, problem is solved.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.