Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When a server won't boot but you still have a functioning hard drive, you still should be able to extract the stored SSL certificates and keys, right? The information is all there after all.

The system certificates are stored in the registry here:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\My\Certificates

And the associated private keys are stored here:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\My\Keys\

But simply importing those keys into the live registry results in certificates with keys that don't work. How do I extract an SSL certificate off a dead drive?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

It involves more than just the Registry. The locations are described in this MSDN Article: link. The blob you see in the registry under "keys" is a metadata blob, not the actual key. The actual key is stored encrypted in the file-system in the All Users profile.

All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys

The MSDN article lists where keys are stored for various key-owners.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.