Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When a server won't boot but you still have a functioning hard drive, you still should be able to extract the stored SSL certificates and keys, right? The information is all there after all.

The system certificates are stored in the registry here:

And the associated private keys are stored here:

But simply importing those keys into the live registry results in certificates with keys that don't work. How do I extract an SSL certificate off a dead drive?

share|improve this question
up vote 4 down vote accepted

It involves more than just the Registry. The locations are described in this MSDN Article: link. The blob you see in the registry under "keys" is a metadata blob, not the actual key. The actual key is stored encrypted in the file-system in the All Users profile.

All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys

The MSDN article lists where keys are stored for various key-owners.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.