Not all websites or applications use IIS or Exchange for its SSL configurations, but they may refer to the Windows MMC certificate stores for their configurations and may need to move an SSL certificate from one system to another.
Windows servers use .pfx/.p12 files to contain the public key file (SSL Certificate) and its unique private key file. The Certificate Authority (CA) provides you with your SSL Certificate (public key file). You use your server to generate the associated private key file where the CSR was created.
You need both the public key and private keys for an SSL certificate to work properly on any system. Windows uses the pkcs#12 (pfx/p12) file to contain these two keys and another of intermediate certificates along the chain of trust; therefore, if you need to transfer your SSL certificate from one Windows system to another or store it someplace for safe keeping you need to create a pkcs#12 (pfx/p12) backup.
To backup, export, and move a SSL certificate from one Windows system to another with its private key perform the following steps.
Step 1: Create an MMC Snap-in for Managing Certificates on the first Windows system where the SSL certificate is installed.
- Start > run > MMC.
- Go into the Console Tab > File > Add/Remove Snap-in.
- Click on Add > Click on Certificates and click on Add.
- Choose Computer Account > Next.
- Choose Local Computer > Finish.
- Close the Add Standalone Snap-in window.
- Click on OK at the Add/Remove Snap-in window.
Step 2: Export/Backup certificate to .pfx file:
- In MMC Double click on Certificates (Local Computer) in the center window.
- Double click on the Personal folder, and then on Certificates.
- Right Click on the Certificate you would like to backup and choose > ALL TASKS > Export
- Follow the Certificate Export Wizard to backup your certificate to a .pfx file.
- Choose to ‘Yes, export the private key‘
- Choose to “Include all certificates in certificate path if possible.” (do NOT select the delete Private Key option)
- Enter a password you will remember.
- Choose to save file on a set location.
- Click Finish.
- You will receive a message > “The export was successful.” > Click OK.The .pfx file backup is now saved in the location you selected and is ready to be moved or stored for your safe keeping.
Step 3: Creating a MMC certificate snapin on the second Windows system:
- Start > run > MMC.
- Go into the Console Tab > File > Add/Remove Snap-in.
- Click on Add > Click on Certificates and click on Add.
- Choose Computer Account > Next.
- Choose Local Computer > Finish.
- Close the Add Standalone Snap-in window.
- Click on OK at the Add/Remove Snap-in window.
Step 4: Importing your backup .pfx file to the second Windows system:
Note: Depending on the application and how it was designed it may refer to a different store repository and not the Personal store as seen with most applications. You may have to contact your application vender in order to determine what store repository the SSL certificate needs to be imported under.
- Open the Microsoft Management Console (MMC).
- On the left pane, expand Certificates.
- Double-click Personal.
- Right-click Certificates and select All Tasks > Import (this opens the Certificate Import Wizard). Click Next.
- Browse to the PKCS#12 (.pfx) file that you want to import and click Next.
- Enter the password used to secure the certificate for export and then click OK.
- To export the certificate again from this computer, select Mark the key as exportable.
- Select the option Automatically select the certificate store based on the type of certificate. (This ensures all the certificates in the certification path (Root, Intermediate, and Server) are stored in the proper place. Problems may occur if a certificate is placed in the wrong store.) Click Next.
- Click Finish. A message confirms successful import. Click OK. You should now see your certificate under the Personal Certificates store in MMC.
Your SSL Certificate has now been migrated from one Windows system to another.
If you are unable to use these instructions for your server, Acmetek recommends that you contact either the vendor of your software or an organization that supports it.
Microsoft Support
For more information refer to Microsoft.
About SSLSupportDesk:
SSLSupportDesk is part of Acmetek who is a Symantec Website Security Solutions Authorized Distributor and a Platinum Partner. Acmetek offers all 4 Brands of SSL Certificates: Symantec, Thawte, GeoTrust and RapidSSL. Offering Norton Shopping Guarantee that inspires trust and increases online sales with a 20x ROI Guarantee.
Contact an SSL Specialist to buy your SSL Certificates from Acmetek, a Symantec Strategic/Platinum Distributor.
Become a Partner and create additional revenue stream while the heavy lifting for you.