> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Export the Futurex EKM TLS client PKI from Windows Certificate Store

> Procedural guide to export a TLS client PKI from Windows Certificate Store using PowerShell.

In the previous section, we imported the TLS CA certificate that signed the client and server TLS certificates into the **Trusted Root Certification Authorities** Windows Certificate Store. Then, we associated the signed Futurex EKM TLS client certificate with its corresponding private key stored in Windows Certificate Store.
In this section, we will use the **Export-PfxCertificate** PowerShell cmdlet to export the TLS client PKI as a PKCS #12 file. In the next section, we will configure the PKCS #12 file inside the Futurex EKM configuration file (i.e.,
fxekm.cfg) and use it for the TLS connection to the Excrypt Port on the HSM.

## Determine the thumbprint of the Futurex EKM Certificate Stored in Windows Certificate Store

To list certificates stored in the Local Machine store, run the folowing command in PowerShell:

```powershell title="Powershell" expandable lines wrap theme={null}
  $ Get-ChildItem -Path Cert:\LocalMachine\My
```

You should see output similar to the following:

```none title="Text" expandable lines wrap theme={null}
  Thumbprint                                            Subject
  ----------                                            ----------
  ADDCFB89CB1CAE80AB386007C200D7D31BAAFB14              CN=Futurex EKM
```

Copy the thumbprint value that you see to the clipboard.

## Export the Futurex EKM client PKI using the Export-PfxCertificate PowerShell command

Run the command below, substituting "YOUR\_CERTIFICATE\_THUMBPRINT\_HERE" and "YOUR\_PASSWORD\_HERE" with the actual thumbprint and password values.

```powershell title="Powershell" expandable lines wrap theme={null}
  $ Export-PfxCertificate -Cert "Cert:\LocalMachine\My\YOUR_CERTIFICATE_THUMBPRINT_HERE" -FilePath "ClientPKI.p12" -Password (ConvertTo-SecureString -String "YOUR_PASSWORD_HERE" -Force -AsPlainText)
```