Skip to main content
This appendix shows the necessary steps to migrate a certificate private key, currently stored in software, to a Vectera Plus HSM. You can use the following methods to export a private key from a Windows Certificate Store: Use the MMC Certificates Snap-In or PowerShell commands. Both involve exporting the private key as a PKCS #12 file. Regardless of which method you choose to export the PKCS #12 file from Windows, you must use FXCLI to import the private key contained within the PKCS #12 file into the Vectera Plus HSM.
Before exporting the PKCS #12, mark the private key of the certificate as exportable.

​
Export the private key

You can export the private key from the Windows Certificate Store as a PKCS #12 file by using one of the following methods:
  1. Use the MMC Certificates Snap-In.
  2. Use PowerShell commands.
Select the appropriate method and follow the steps: MMC Certificates Snap-In:
1
In the MMC Certificates snap-in, right-click the certificate that you want to export and select All Tasks > Export to start the Certificate Export Wizard.
2
In the first dialog, select [ Next ] to continue.
3
Select the Yes, export the private key radio button, and select [ Next ].
4
Select the Personal Information Exchange - PKCS #12 (.PFX) radio button (selected by default), and select the Delete the private key if the export is successful option checkbox. Then, select [ Next ].
5
Select the Password checkbox and enter a password. This protects the private key in the PKCS #12 file. Select [ Next ].
6
Select [ Browse ], enter a name for the export file, select the save location, and select [ Next ].
Use either a .p12 or .pfx extension for the file.
7
Review the summary of the selected options and select [ Finish ].
A notification window pops up stating that the export was successful.
PowerShell:
1
Open Windows PowerShell as an administrator.
2
Run the following command to determine the Thumbprint of the certificate or private key you want to export:
Powershell
The My directory in the file path represents the Personal certificate store.
3
Run the following command to save a password string into the $mypwd variable. This is the password for the PKCS #12 file.
Powershell
4
Use the following command to export the PKCS #12 file, substituting Thumbprint with the actual thumbprint value of the certificate that you want to export in the -Path flag.:
Powershell
5
PowerShell does not provide an option in the Export-PfxCertificate command to delete the private key after successfully exporting the PKCS #12 file. To delete the private key, you must use the Remove-Item PowerShell command. This command also deletes the certificate, so you must reimport the certificate afterward.First, run the following commands to export the certificate so that you can reimport it:
Powershell
Then run the following command to delete the certificate and its private key:
Powershell
6
Run the following command to import the certificate back into the Personal Certificate Store, defining the actual location of the certificate in the -FilePath flag.:
Powershell

​
Import the PKCS #12 file

Perform the following steps to import the PKCS #12 file into the Vectera Plus using FXCLI:
1
Run the FXCLI application.
2
Configure TLS certificates for communication between FXCLI and the HSM by using the tls commands.
Run tls help to access syntax documentation.
3
Run the following command to connect to the HSM:
FXCLI
4
Log in to the HSM with the default Admin1 and Admin2 identities by running the following command twice, entering the username and password when prompted:
FXCLI
5
Run the following command to import the PKCS #12 file, modifying the file path to match the actual location of the PKCS #12 file that you exported from Windows:
FXCLI
When prompted, enter the password of the PKCS #12 file.
The preceding command imports only the private key contained within the PKCS #12 file into the HSM. It does not import the certificate.
6
Confirm the key slot of the imported private key:
FXCLI
7
Because certutil needs you to set an external label so it can find the key, run the following command to assign a PKCS11 label to the key:
The PKCS11 label value should match the value that you set in the --label field while importing the PKCS #12 file.
FXCLI

​
Reassociate the certificate

Perform the following steps to reassociate the certificate stored in Windows with the private key stored on the HSM:
1
Double-click the certificate in the MMC Certificates snap-in, go to the Details tab, and note down the listed serial number value.
2
Open Windows PowerShell or Command Prompt as an administrator.
3
Run the following command to associate the certificate with its corresponding private key stored on the HSM, substituting the serial_number placeholder with the actual serial number value of the certificate:
Powershell
If the command succeeds, the following message displays:
Powershell
4
To confirm that the certificate is now associated with its corresponding private key on the HSM, double-click the certificate in the MMC Certificates snap-in.
You should see the following message: You have a private key that corresponds to this certificate.