IIS - Backup and restore pending request
With this manual a pending certificate request can be back-upped to a file, together with the private key. In addition this manual describes how the backup can be restored.
Open Local Machine certificate store
- Click Start → Run, type mmc and click OK:
- Go to menu File and choose Add/Remove Snap in:
- Select Certificates and click on Add:
- Select Computer Account. Note: This step is very important: it must be the computer account (and no other). Click on Next:
- Choose Local Computer and click on Finish.
- Close the Add Standalone Snap-in box, click OK in the Add/Remove Snap-in window and go back to the MMC.
Making a backup of the Private Key and the Pending Request
- Expand the tree under Certificates (Local Computer) and find a folder named Request or Certificate Enrolment Requests. In this folder there is a sub-folder named Certificates. This contains the key which corresponds with the pending Certificate Request.
- Select the key of which a backup must be made.
- Right-click the key, click All Tasks, and then Export... to start the Certificate Export Wizard:
- Click on Next:
- Choose the option Yes, export the private key and then click Next:
- Accept the default settings on the Export File Format page and click Next:
- Enter a password to secure the private key and then click Next.
- Enter the file name and -path for the backup, with the extension .pfx.
Note: it is sensible to save the Private Key on another medium (for instance a USB stick), and preferably another physical location as well. That way the Private Key can be easily restored if there is a technical problem. Then click Next:
- Click Finish.
- A message appears indicating the export was successful.
Restoring a backup of the Private Key and Pending Request
- Open the Certificates MMC Snap-in as described in the first part of this manual. Expand the tree under Certificates (Local Computer) and look for a folder named Request or Certificate Enrolment Requests. In this folder there is a sub-folder named Certificates.
- Right-click the Certificates folder, choose All Tasks and click Import.
- The Certificate Import Wizard is started. Click Next:
- Click Browse... and choose the .pfx file with the previously created backup of the Private Key and the Pending Request, and click Next:
- Enter the password for the .pfx file (which was set when creating the file), select Mark the Private key as exportable and click Next:
- Select Place all certificates in the following store. Make sure the default certificate store is set to Certificate Enrollment Requests and click on Next.
- At the end of the Certificate Import Wizard page, click Finish. A message will appear stating that the import is successful.
- A message will appear stating that the import is successful.