> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Appendix: Migrate a key from software storage to the Vectera Plus
> Instructions to migrate a software-stored private key to the Vectera Plus HSM via PKCS#12 import.
This appendix shows the necessary steps to migrate a certificate private key, currently stored in software, to a Vectera Plus HSM.
You can use the following methods to export a private key from a Windows Certificate Store: Use the MMC Certificates Snap-In or PowerShell commands. Both involve exporting the private key as a PKCS #12 file.
Regardless of which method you choose to export the PKCS #12 file from Windows, you must use FXCLI to import the private key contained within the PKCS #12 file into the Vectera Plus HSM.
Before exporting the PKCS #12, mark the private key of the certificate as exportable.
## Export the private key
You can export the private key from the Windows Certificate Store as a PKCS #12 file by using one of the following methods:
1. Use the MMC Certificates Snap-In.
2. Use PowerShell commands.
Select the appropriate method and follow the steps:
**MMC Certificates Snap-In:**
In the **MMC** **Certificates** snap-in, right-click the certificate that you want to export and select **All** **Tasks** > **Export** to start the **Certificate Export Wizard**.
In the first dialog, select **\[ Next ]** to continue.
Select the **Yes, export the private key** radio button, and select **\[ Next ]**.
Select the **Personal Information Exchange - PKCS #12 (.PFX)** radio button (selected by default), and select the **Delete the private key if the export is successful option** checkbox. Then, select **\[ Next ]**.
Select the **Password** checkbox and enter a password. This protects the private key in the PKCS #12 file. Select **\[ Next ]**.
Select **\[ Browse ]**, enter a name for the export file, select the save location, and select **\[ Next ]**.
Use either a `.p12` or `.pfx` extension for the file.
Review the summary of the selected options and select **\[ Finish ]**.
A notification window pops up stating that the export was successful.
**PowerShell**:
Open Windows PowerShell as an administrator.
Run the following command to determine the **Thumbprint** of the certificate or private key you want to export:
```powershell expandable lines wrap title="Powershell" theme={null}
PS C:\>ls Cert:\LocalMachine\My\
```
The My directory in the file path represents the Personal certificate store.
Run the following command to save a password string into the **\$mypwd** variable. This is the password for the PKCS #12 file.
```powershell expandable lines wrap title="Powershell" theme={null}
PS C:\>$mypwd = ConvertTo-SecureString -String "safest" -Force -AsPlainText
```
Use the following command to export the PKCS #12 file, substituting **Thumbprint** with the actual thumbprint value of the certificate that you want to export in the `-Path` flag.:
```powershell expandable lines wrap title="Powershell" theme={null}
PS C:\>Get-ChildItem -Path Cert:\LocalMachine\My\Thumbprint | Export-PfxCertificate -FilePath "C:\Path\To\Desired\Save\Location\file.pfx" -Password $mypwd
```
PowerShell does not provide an option in the **Export-PfxCertificate** command to delete the private key after successfully exporting the PKCS #12 file. To delete the private key, you must use the **Remove-Item** PowerShell command. This command also deletes the certificate, so you must reimport the certificate afterward.
First, run the following commands to export the certificate so that you can reimport it:
```powershell expandable lines wrap title="Powershell" theme={null}
PS C:\>$cert = Get-ChildItem -Path Cert:\LocalMachine\My\Thumbprint
PS C:\>Export-Certificate -Cert $cert -FilePath "C:\Path\To\Desired\Save\Location\file.cer"
```
Then run the following command to delete the certificate and its private key:
```powershell expandable lines wrap title="Powershell" theme={null}
PS C:\>Remove-Item -Path Cert:\LocalMachine\My\Thumbprint -DeleteKey
```
Run the following command to import the certificate back into the Personal Certificate Store, defining the actual location of the certificate in the **-FilePath** flag.:
```powershell expandable lines wrap title="Powershell" theme={null}
PS C:\>Import-Certificate -FilePath "C:\Path\To\Certificate\file.cer" -CertStoreLocation Cert:\LocalMachine\My
```
## Import the PKCS #12 file
Perform the following steps to import the PKCS #12 file into the Vectera Plus using FXCLI:
Run the FXCLI application.
Configure TLS certificates for communication between FXCLI and the HSM by using the **tls** commands.
Run tls help to access syntax documentation.
Run the following command to connect to the HSM:
```shell title="FXCLI" expandable lines wrap theme={null}
connect tcp --connect hsm_ip:9009
```
Log in to the HSM with the default **Admin1** and **Admin2** identities by running the following command twice, entering the username and password when prompted:
```shell title="FXCLI" expandable lines wrap theme={null}
login user
```
Run the following command to import the PKCS #12 file, modifying the file path to match the actual location of the PKCS #12 file that you exported from Windows:
```shell title="FXCLI" expandable lines wrap theme={null}
pkcs12 import --file /path/to/pkcs12/file.pfx --slot next --label MigrationDemoKeyPair --win-system-dacl
```
When prompted, enter the password of the PKCS #12 file.
The preceding command imports only the private key contained within the PKCS #12 file into the HSM. It does not import the certificate.
Confirm the key slot of the imported private key:
```shell title="FXCLI" expandable lines wrap theme={null}
keytable list
```
Because **certutil** needs you to set an external label so it can find the key, run the following command to assign a PKCS11 label to the key:
The PKCS11 label value should match the value that you set in the `--label` field while importing the PKCS #12 file.
```shell title="FXCLI" expandable lines wrap theme={null}
keytable extdata --slot 3 --p11-attr label --p11-value MigrationDemoKeyPair
```
### Reassociate the certificate
Perform the following steps to reassociate the certificate stored in Windows with the private key stored on the HSM:
Double-click the certificate in the **MMC** **Certificates** snap-in, go to the **Details** tab, and note down the listed **serial** **number** value.
Open Windows PowerShell or Command Prompt as an administrator.
Run the following command to associate the certificate with its corresponding private key stored on the HSM, substituting the **serial\_number** placeholder with the actual serial number value of the certificate:
```powershell expandable lines wrap title="Powershell" theme={null}
certutil -repairstore -csp "Futurex CNG" My "serial_number"
```
If the command succeeds, the following message displays:
```powershell expandable lines wrap title="Powershell" theme={null}
CertUtil: -repairstore command completed successfully.
```
To confirm that the certificate is now associated with its corresponding private key on the HSM, double-click the certificate in the **MMC** **Certificates** snap-in.
You should see the following message: You have a private key that corresponds to this certificate.