Export Certificate with Private Key from CA Management MMC

[Nitnam]

At our corporate office we are running a Windows 2003 Domain with Enterprise Certificate Authority and have also minted few client Authentication certificates. We have also marked the private keys as exportable. So far I don’t have any problem installing certs using the web certificate service or in exporting export the certificate. But what I am trying to do is mint the cert as an administrator for somebody else and tried exporting the certificate with private key directly from the CA rather than installing the certificates locally on my machine and then exporting them.

Here I need you guys help. I wanted to know if there is anyway I can export the certificate and private key directly from the CA, rather than installing it locally on my workstation and exporting ? If yes, please help.

[Lyla Rose]

Yes, by default Webserver certificate wont allow you to export the private key. And that is good feature if we will see it from security perspective. However if you don’t want it anymore in the environment then can simply create a new Webserver template on your CA and enable "export private key" property. So you just need to create new one using current webserver certificate template.

[Brandy]

Hi

Additionally you may start thinking about KRA and Key archival.

[Nitnam]

Thank yoiu very much for all your helps guys. I think yes i need to to archive the keys, and use a key recovery agent to restore the certificate with the private key.Hope it works for me.