Overall System Status:
Your private and public certificates are saved on the computer from which you enrolled in the PKI system. For the purposes of Web authentication, it is possible to enroll more than once, but this can be confusing for other uses of PKI, like encryption and digital signatures. In those cases, it is preferable to use the same private and public certificates on multiple web browsers and computers. To move your PKI private certificate to another web browser or computer:
Because the applications of PKI rely on keeping your private certificate "private," the process for doing this keeps the information encrypted as it is being moved.
The Internet PKI standards define a format called PKCS #12 for transferring private and public certificates. (A PKCS #7 file is used to transfer public certificates only; not the private certificate.) PKCS #12 is supported by Safari 2.0 or greater, Netscape, Firefox, and Internet Explorer 5.5 or greater. On Windows, the file type .pfx is a synonym for the .p12 file type used by Netscape/Firefox. Some older versions of Windows need file extension definitions to be added for ".p12".
A PKCS #12 file includes a password-encrypted envelope to protect the private certificate. This password is used only for this file and has no connection to the password used to secure your certificates in your web browser or operating system certificate storage. The password is created when you create the .p12 export file and must be provided to decrypt the contents when you import the file somewhere else. The certificate export and import functions are usually part of the user interface provided to manage certificates in web browsers. Be sure to transfer the binary file by a method that doesn't mistakenly convert it to text. This is easy to do since the settings in many programs default to "text" files. The file can be e-mailed as a binary attachment, transferred as a binary file with FTP, or copied to and from a removable or shared disk. A copy of your certificate on a removable disk can be a useful backup if the hard disk on your computer fails.
Instructions for the most common browsers are provided on the Getting a Certificate web page. web browsers that support personal PKI certificates will have similar features that should be easy to find.
If you really need to move a certificate from one browser to another, import it into the second browser, then delete it from the first browser. Or, you can leave the original copy of the certificate in both browsers and use it from either.
Last Updated: 2/18/10