Monday, December 3, 2018

Export-PfxCertificate won't export non-exportable private keys

Upon import to the certificate store, private keys can be marked as non-exportable. A commenter on Super User pointed out that PowerShell's Export-PfxCertificate cmdlet fails on such certificates. That makes sense, though I had hoped the non-exportability restriction was only enforced by UI. There are unofficial/unsupported ways to get around this by using tools like Mimikatz.

No comments:

Post a Comment