I tried to follow the website below for instructions on how to generate the CSR for my web server:


However, it only generates the CSR. Where is the private key? I was told that the key is generated at the time of CSR generation.

I am using Windows 10. I plan to use node.js Express. Are there alternative tools we can use to generate CSR on Windows 10?


1 Answer 1


It's stored in the Windows certificate store. When you import the signed certificate, you will find you have a corresponding private key. It matches them by modulus, if I recall.

You can get a list of the private keys you have as a result of certificate enrollment requests (such as you made with certreq) by running certmgr.msc for the computer account (or simply certlm.msc for Windows 2012R1 or Windows 8 onwards).

The keys are in the Certificate Enrollment Requests folder.

The easiest thing to do if you need to use the certificate without using the API is to import the certificate, export it, and use openssl to transform the resulting PKCS5 into a PEM certificate and key.

You can also use openssl to generate keys and certificate requests, and if you plan to use them in PEM format on the filesystem rather than using the Windows API, you might as well do that.

  • It seems that the store is not a directory. I was under the impression that the key is a file I can refer to in my script. Aug 27, 2015 at 9:03
  • 4
    Indeed, it is not a directory. You have to export it if you want a file. Aug 27, 2015 at 9:21
  • 4
    for "Certificate Enrollment Requests", choose "computer account" while loading certmgr.msc via MMC
    – F.I.V
    Dec 26, 2017 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.