FAQs

Why am I unable to export my Sectigo S/MIME certificate as a .PFX file?

Updated on August 14, 2026

Overview

By the end of this article you will know whether your Sectigo Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate can be exported as a Personal Information Exchange (.PFX) file, and what to do if it cannot.

A .PFX export is only possible when the certificate and its matching private key are on the same system, so the article first explains why the private key is often missing — usually because the Certificate Signing Request (CSR) was generated on a different machine, browser, or storage device.

It then covers how to check for the private key in Windows, how to export the certificate, how to create a .PFX file with OpenSSL, and what to do when the private key cannot be recovered.

Why this happens

A Sectigo S/MIME certificate can only be exported as a Personal Information Exchange (.PFX) file if the private key created with the Certificate Signing Request (CSR) is stored on the same system.

The export fails in these situations:

The CSR was generated on a different machine from the one where you are installing and exporting the certificate.
The CSR was generated in a different browser or on a different system than the one you are using now.
The certificate is installed in a location that does not allow private key export, such as a smart card or a Hardware Security Module (HSM).

How the certificate was requested affects the export

A Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate can be requested in two ways, and each has its own requirement for keeping the private key available. Retail customers can use the manual method only.

Method	Where the Certificate Signing Request (CSR) is created	Requirement for a successful .PFX export
Browser-based	In the browser, at the time of the request	Install the certificate in the same browser and on the same machine used to generate the CSR
Manual	On the operating system — Microsoft Management Console (MMC) snap-in or `certreq` on Windows, or OpenSSL on the command line	Install the certificate on the same device where the CSR was generated, using the same method

Check whether the private key is present

Confirm the private key is on the machine before attempting an export.

On Windows:

Press Win + R, type certmgr.msc, and press Enter to open Certificate Manager.
Go to Personal > Certificates.
Select your Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate.
Confirm the certificate details show "You have a private key that corresponds to this certificate". If this message appears, the certificate can be exported as a Personal Information Exchange (.PFX) file.

Export the certificate as a .PFX file

Once the private key is confirmed present, export the certificate in Certificate Manager:

Right-click the certificate and select All Tasks > Export.
Select Yes, export the private key.
Choose the Personal Information Exchange (.PFX) format and set a strong password.
Complete the export wizard.

Create a .PFX file using OpenSSL

If you hold the certificate and key as separate files, combine them with OpenSSL:

openssl pkcs12 -export -in my.crt -inkey my.key -certfile my.bundle -out my.pfx

If the private key is missing

A certificate cannot be exported as a Personal Information Exchange (.PFX) file without its private key, and Sectigo cannot supply a replacement key — the private key is never transmitted to Sectigo, for security reasons.

The certificate must be reissued:

Contact Sectigo Support and raise a ticket to cancel the order and receive store credit.
Sign in to your Sectigo account and use the store credit to purchase a new Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate.
Generate a new Certificate Signing Request (CSR) on the system where the certificate will be used.
Submit that CSR with the certificate order.
Complete validation and install the new certificate on the same system.

Best practices

Follow these practices to keep a Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate exportable:

Generate the Certificate Signing Request (CSR) and install the certificate on the same machine.
Back up the private key securely during installation.
Use a strong password whenever you export a Personal Information Exchange (.PFX) file.