IIS 8-10: PFX Export

Overview

This guide demonstrates how to export an installed SSL/TLS certificate from IIS 8, 8.5, or 10 into a PFX file (PKCS#12). Exporting to PFX is necessary when you need to:

• Create a backup of the certificate and its private key
• Migrate the certificate to a different server
• Import the certificate into another application (such as Exchange or ADFS)

Supported Versions

IIS Version	Windows Server
IIS 8.0	Windows Server 2012
IIS 8.5	Windows Server 2012 R2
IIS 10.0	Windows Server 2016, 2019, 2022, 2025

Prerequisites

• Administrator privileges on the server
• The certificate must have been installed with an exportable private key

Method 1: Export via MMC

1. Press Windows + R, type mmc.exe and click OK.
2. Select File → Add/Remove Snap-in.
3. Select Certificates, click Add, then choose Computer account → Local computer. Click Finish and OK.
4. Navigate to Certificates (Local Computer) → Personal → Certificates.
5. Right-click the certificate you wish to export → All Tasks → Export.
6. Select Yes, export the private key. Click Next.
7. Select Personal Information Exchange - PKCS #12 (.PFX). Tick Include all certificates in the certification path if possible to ensure intermediate certificates are included. Click Next.
8. Select Password and enter a strong password to secure the PFX file. Click Next.
9. Choose a filename and path (e.g. C:\backup\eksempel-dk-2026.pfx). Click Next and then Finish.

[Screenshot: MMC → Personal → Certificates → All Tasks → Export]

Method 2: Export via certlm.msc (Windows Server 2012+)

1. Press Windows + R, type certlm.msc and press Enter.
2. Navigate to Personal → Certificates.
3. Right-click the certificate → All Tasks → Export.
4. Follow the export wizard as described in Method 1.

Method 3: Export via PowerShell

# Find certifikatet
Get-ChildItem -Path Cert:\LocalMachine\My | Format-Table Subject, Thumbprint, NotAfter

# Eksporter til PFX
$cert = Get-ChildItem -Path Cert:\LocalMachine\My\THUMBPRINT_HER
$password = ConvertTo-SecureString -String "DitStaerkePassword" -AsPlainText -Force
Export-PfxCertificate -Cert $cert -FilePath "C:\backup\eksempel-dk-2026.pfx" -Password $password

Troubleshooting

• "Yes, export the private key" is greyed out: The private key was not marked as exportable when it was originally imported. You must re-import the original PFX file and ensure Mark this key as exportable is selected.
• "The export failed - the key is not exportable": This occurs for the same reason mentioned above.

Security

• Always use a strong password (minimum 16 characters) for PFX files.
• Ensure PFX files are deleted from temporary locations immediately after use.
• Store backup PFX files in a secure location, such as an encrypted drive or a password vault.