Importing PFX certificates on Windows

Understanding PFX files

A PFX file (Personal Information Exchange, also referred to as PKCS#12) bundles the certificate, the private key, and any required intermediate certificates into a single password-protected file. PFX files are the standard format for migrating certificates between servers or restoring them from backups.

Prerequisites

• Windows Server 2012 or newer (or Windows 10/11)
• Administrator access to the server
• The PFX file and its associated password

Importing via certlm.msc (Recommended)

Modern versions of Windows Server and Windows 10/11 include certlm.msc (Local Machine Certificates) as a direct shortcut to the machine's certificate store.

1. Press Windows + R, type certlm.msc and press Enter.
2. Expand the Personal folder and right-click on Certificates.
3. Select All Tasks → Import...
4. Click Next, browse to your PFX file, and click Next.
5. Enter the PFX password. Tick Mark this key as exportable if you need to be able to export the certificate from this server again later.
6. Select Automatically select the certificate store and click Finish.

Importing via MMC (Legacy Windows versions)

For older systems without the certlm.msc shortcut:

1. Press Windows + R, type mmc.exe and press Enter.
2. Go to File → Add/Remove Snap-in.
3. Select Certificates, click Add, and choose Computer account → Local computer.
4. Click OK.
5. Navigate to Certificates (Local Computer) → Personal → Certificates.
6. Right-click and select All Tasks → Import... and follow the wizard as described above.

Importing via PowerShell

$password = ConvertTo-SecureString -String "DitPassword" -AsPlainText -Force
Import-PfxCertificate -FilePath "C:\certifikat.pfx" -CertStoreLocation Cert:\LocalMachine\My -Password $password

Troubleshooting

• "The password you entered is incorrect": PFX passwords are case-sensitive. Ensure you are using the exact password provided when the file was created.
• Missing private key (no key icon): If the certificate icon does not show a small key symbol, it has been imported without its private key. You will need to re-import using the original PFX file or provision a new certificate.
• Missing intermediate certificates: If the chain is broken after import, ensure you are using a PFX that includes the full certificate chain, or import the intermediate certificates manually into the Intermediate Certification Authorities store.