IIS 7: Exporting to PFX

Overview

This guide demonstrates how to export an installed SSL certificate from IIS 7.0 or 7.5 to a PFX file (PKCS#12) on Windows Server 2008 / 2008 R2. Exporting to PFX is necessary when you need to:

Create a backup of the certificate along with its private key
Migrate the certificate to a new server (e.g. when upgrading to Windows Server 2022 or 2025)
Import the certificate into a different application

Note: IIS 7.0 and 7.5 on Windows Server 2008/2008 R2 reached End of Life (EOL) in January 2016. We strongly recommend upgrading to Windows Server 2022 or 2025. You can export the certificate to PFX and import it onto the new server using our IIS 8-10: PFX import guide.

Prerequisites

Windows Server 2008 or 2008 R2 running IIS 7.0 or 7.5
Administrative access to the server
The certificate must be installed with an exportable private key

Step 1 – Open MMC and add the Certificates snap-in

Log in to the server with administrator privileges.
Press Windows + R, type mmc.exe and click OK.
Select File → Add/Remove Snap-in.
Select Certificates and click Add.
Choose Computer account and click Next.
Select Local computer, then click Finish followed by OK.

[Screenshot: MMC → Add/Remove Snap-in → Certificates]

Step 2 – Export the certificate

Navigate to Certificates (Local Computer) → Personal → Certificates.
Right-click the certificate you wish to export → All Tasks → Export.
Select Yes, export the private key. Click Next.
Choose Personal Information Exchange - PKCS #12 (.PFX). Tick Include all certificates in the certification path if possible. Click Next.
Tick Password and enter a strong password for the PFX file. Click Next.
Choose a filename and location (e.g. C:\backup\example-com.pfx). Click Next and then Finish.

[Screenshot: MMC → Personal → Certificates → Export → PFX]

Troubleshooting

"Yes, export the private key" is greyed out: The private key was not marked as exportable during the initial import. You will need to re-import the certificate from the original PFX file with Mark this key as exportable enabled, or generate a new CSR and have the certificate reissued.
"The export failed": Ensure you have full administrative rights and verify that the certificate actually has a private key associated with it.

Security

Always use a strong password for PFX files (minimum 16 characters).
Delete PFX files from temporary locations immediately after use.
Store backup PFX files in a secure, encrypted location.

Next Steps: Upgrading

If you are exporting the certificate to migrate to a newer server, refer to our IIS 8-10: PFX import guide for instructions on Windows Server 2012 through 2025.