Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

What is the proper way to obtain a certificate, ca cert, and private key (aka .pfx file) from a Windows CA via command line?

The way I've been doing it is I create a request file using notepad with all the pertinent settings (exportable=true,enhanced key usage extensions, subject), then using certreq (-new flag) to convert that .inf to a .req, and using certreq to submit that to the CA getting back the certificate. I'll then add that certificate certreq (-accept flag), and then export it with certutil -privatekey -exportpfx flags.

Am I doing that correctly?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

I think you're probably already doing it in as few steps as possible. You cannot have a PFX until after you have both private key and signed CSR, and you cannot have a signed certificate until after the CA has approved your request. (Which may or may not require manual Administrator approval, depending on the certificate template settings.)

However, certreq spirits your private keys away in your certificate store as it generates CSRs, which is why you typically have to complete the certificate request on the same computer from which you generated the request. I can't help but feel that this is at least partly some Microsoft coder's attempts to "protect us from ourselves" because we wouldn't know how to keep our precious private keys private. And I can't really blame them. We'd probably see private keys left dangling around on every web developer's desktop profile on every web server if certreq didn't keep the private keys away from them.

Anyway, I digress, but if you want more flexibility over your private key than certreq gives you, use the OpenSSL command line tool to generate your private keys. (openssl genrsa -out private.key 2048 ) Then you can do whatever you want with them without that extra step of having to export them from your certificate store.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.