PowerShell module · 17.8
Export a certificate
Some systems cannot be reached by a deployment and need the key material as a file. -OutFile writes the file. Without -OutFile, you only receive information about the export, not the certificate itself.
$pw = Read-Host -AsSecureString 'PFX password'
Export-TLSPilotCertificate -CertificateId $id `
-Format pfx -PfxPassword $pw -OutFile 'C:\Temp\web01.pfx'
The parameters:
| Parameter | Default | Effect |
|---|---|---|
-Format | pfx | pfx, pkcs8, pkcs1 or encrypted-pem, as in the dialog. The values pem-cert, pem-key and pem-bundle are accepted as aliases. |
-PfxPassword | – | Password of the PFX as SecureString. Required with pfx, and with encrypted-pem when the private key is included; otherwise the command stops with A PFX password is required. (pfx) or Encrypted PEM requires a password. (encrypted-pem) |
-OutFile | – | Path of the file to write. |
-IncludePrivateKey | $true | Includes the private key. pfx always contains the key. |
-IncludeChain | $true | Includes the intermediates. |
-SeparateFiles | $false | Writes the key in a file of its own. Has no effect with pfx and with the aliases pem-cert, pem-key and pem-bundle, which define the files themselves. |
-IncludeRoot | $false | Appends the root. Only effective with -IncludeChain $true. |
-ReverseChainOrder | $false | Reverse chain order (root first). Only effective with -IncludeChain $true and not for pfx. |
Export-TLSPilotCertificate -CertificateId $id -Format pkcs8 `
-IncludePrivateKey $false -IncludeChain $true -IncludeRoot $true -OutFile 'C:\Temp\web01-chain.pem'
If the root is not found, the command writes the file without it and shows the warning The root certificate was not in the stored chain and was not found on this management host. The file was written without the root. If a PFX with chain cannot be built, it stops with PFX export could not build the certificate chain. The file was not written. See also chapter Export options and chapter Certificate formats.