Export Secure Channel certificates from the Microsoft Management Console

This is a procedure for exporting Secure Channel communication certificates from the Windows Microsoft Management Console (MMC).

You can use the Microsoft Management Console (MMC) Export function to export certificate files with (PFX) or without (CER) private keys. These files can be exported to move them to another gateway or client computer, or they exported to archive or back up the files. If you intend to use the SecureChannelCertificateInstaller.ps1script, format the file names correctly following the instructions at Secure Channel Script File Names. You will use the CA password (from creating the CA with the script or from creating the CSR) to export certificates with private keys.

The following files can be exported for use with Secure Channel communication:

• A certificate authority (CA) file without private key

• One or more gateway certificate files with private key (PFX) for installation on one or more gateway computers (one per gateway computer), or for use with the SecureChannelCertificateInstaller.ps1 script, which can use this type of file to install gateway certificates on gateway and client Windows computers.

• One or more gateway certificate files without private key (CER) for installation on one or more client computers. The SecureChannelCertificateInstaller.ps1 script doesn't use this type of file.

• One or more client certificate files with private key (PFX) for installation on one or more client computers (one per client computer), or for use with the SecureChannelCertificateInstaller.ps1 script (which can use this type of file to install client certificates on gateway and client Windows computers.

• One or more client certificate files without private key (CER) for installation on one or more gateway computers, using the MMC. The SecureChannelCertificateInstaller.ps1 script doesn't use CER files.

Here are Directions to export certificate files from the MMC.

1. Open the MMC and add the certificate snap-ins, or restore the console settings that include the certificate snap-ins.

2. Navigate to the correct Windows certificate store (see certificate locations), locate the certificate and right-click it, then select All Tasks > Export … to open the Export wizard. (An alternate way to open this wizard is to select the certificate, then from the Console main menu, select All Tasks > Export ….) Click Next to continue.

   The example below is exporting the CA certificate from the Certificates (Local Computer) > Personal store.

   

   

3. At the next step, if the installed certificate has the private key, the wizard will prompt you to choose whether or not export the private key. Choose and click Next. If choosing No, do not export the private key, skip the next two steps and go to step 6. If choosing Yes, export the private key, continue to the next step.

   • The CA certificate do not need the private key if it is being exported to be installed on a gateway computer or a client computer. Export it with a key for backup or archival purposes, or it you are copying it to another computer where it will be used to create new signed (with the private key) certificates.

   • Gateway certificates being exported for installation on a gateway computer and client certificates being exported for installation on the appropriate client computer need the private key.

   • Gateway certificates being exported for installation on a client computer and client certificates being exported for installation on a client computer do not need the private key.

   • If exporting a certificate for use by the SecureChannelCertificateInstaller.ps1 script, include the private key. This script doesn't use certificates without the private key.

     

4. If creating a certificate with a private key (choosing Yes, export the private key in step 3), you will see this wizard panel. Check the three boxes shown (Include all certificates in the certification path if possible, Export all extended properties, and Enable certificate privacy) and click Next.

   

5. If creating a certificate with a private key, you will see this wizard panel next. Check the Password check box and fill in the password that was used to create the CA (either from the script or from a CSR), then click Next. Skip the next step, and go to Step 7.

   

6. If creating a certificate without a private key (choosing No, do not export the private key in step 3), you will see this wizard panel. Choose the first option, DER encoded binary X.509 (.CER), and click Next.

   

7. At this wizard panel, fill in the destination folder through typing or browsing. This is a standard Windows interface.

   

8. At this wizard panel, you can review the choices made so far. If something should be changed, use the upper left-hand corner back arrow to navigate to the appropriate panel. If the settings are correct, click Finish. There will be an additional dialog confirming that the process was successful; click OK.