Windows public key infrastructure (PKI) users have several options for manually backing up their private encryption keys. The preferred and most commonly used format for archived private keys is a Public-Key Cryptography Standards (PKCS) #12 (.pfx) file. Users can use a password to secure access to and confidentiality of a .pfx file's content. To manually back up private keys to this type of file, a user can do one of the following:
- Use the Microsoft Management Console (MMC) Certificates snap-in to open his or her personal certificate store. Right-click the certificate of the private key the user wants to back up, then select All Tasks, Export from the context menu. This action launches the Certificate Export Wizard. The user must select both the Yes, export the private key and the Enable strong protection (requires IE 5.0, NT 4.0 SP4 or above) options. The latter option will make the wizard prompt the user for a password to protect the .pfx file's content. The user shouldn't select the Delete the private key if export is successful option.
- Open Microsoft Internet Explorer (IE) 6.0 and select Tools, Internet Options from the menu bar. In the Internet Options dialog box, go to the Content tab. Click Certificates to open the Certificates dialog box. Select the certificate of the private key the user wants to export, then click Export to launch the Certificate Export Wizard. Use the same options I described previously.
Users can also archive their private encryption keys from Microsoft Outlook. Outlook doesn't store the keys in a .pfx file; instead, it uses a special Outlook export (.epf) file. The .epf extension shows the historical roots of Outlook's secure mail technology: EPF stands for Entrust profile. One reason Outlook still uses this format is that it supports X.509 Version 1 certificates, which early Exchange Key Management Service (KMS) implementations use. As with .pfx files, users can use a password to secure .epf files.
To export private encryption keys from Outlook, a user can select Tools, Options from the Outlook menu bar, then go to the Security tab. At the bottom of the Security tab, the user should click Import\Export to open the Import\Export Digital ID dialog box. In that box, the user should select the Export your Digital ID to a file option, then select the Digital ID of the private key the user wants to export and fill in a filename and password. The user shouldn't select the Delete Digital ID from system check box.
