How to Export Your Digital Certificate and Back It Up (PC, Mac, and Mobile)
You change computers, format your PC, or lose your phone. Without a backup, your digital certificate goes with it.
Recovering it is not a click away: you have to request it again and prove your identity. This guide teaches you how to make a backup on Windows, Mac, Android, and iPhone, and how to install it on another device.
It is the backup of the certificate with its private key, protected by a password. According to the FNMT, the name depends on the program: .pfx from the Windows wizard and .p12 from Firefox and Mac Keychains. They install the same way.
Before you start: where your certificate is stored
The method depends on where it is installed.
Chrome, Edge, and Firefox on the computer, or Keychain on Mac. You can export it by following this guide.
It depends on how you downloaded it. We explain more below.
The FNMT indicates that a certificate obtained on a card cannot be exported with its private key. If you plan to move it to a card or key, make the backup first.
If you do not check "Export the private key" when exporting, you get a .cer file that does not work as a backup. According to the FNMT, if you cannot repeat the export from the original, you will have to request a new certificate.
Export the certificate on Windows (Chrome)
In Chrome: Settings → Privacy and security → Security → Manage certificates → "Manage certificates imported from Windows".
It is in the "Personal" tab. A Windows wizard opens. Click "Next".
This is the key step. Leave the file format with the default options.
Type a password and confirm it. You will need it every time you import the backup. Save it in a password manager.
Click "Browse", choose where to save it, "Next", and "Finish". Windows warns that the private key is being exported: accept. You will see a success message.
Edge: Settings → search "Certificates" → Manage certificates → "Personal" tab → Export. Then follow the same wizard.
Firefox stores certificates separately. Go to Preferences → Privacy & Security → View Certificates → "Your Certificates" tab, choose yours, and click "Make a Backup". Set a password. It will generate a .p12 file. On Mac, write the .p12 extension yourself when naming the file.
Export the certificate on Mac
Safari and Chrome on Mac use the system Keychain.
In Finder: Go → Utilities → Keychain Access.
Select your certificate from the list.
Choose name and folder. The resulting format is .p12.
Click OK. That password will protect the file.
Backup on your phone
On your phone the situation is different: there is not always an "export" button.
Android
If you downloaded the certificate with the FNMT app and agreed to make a backup, the file already exists. Search for it with "Files" or "My Files" in the Downloads folder: it has your name and ends in .p12.
According to the FNMT manual, if you didn't make the backup at that time, you won't be able to do it later from your phone. In that case use your computer backup, if you have it.
iPhone
The FNMT indicates that you can download it again if you keep the request in "View requested certificates". During download it asks if you want to share it. Share it with the Mail app and send it to your email. Then, save the .p12 on your computer.
Delete the message when you're done and don't send the password through the same channel. Email is for moving it, not for storing it.
Install the backup on another device or phone
With the .p12 or .pfx file and its password you can install the certificate wherever you need it.
Manage certificates imported from Windows → Import → choose the file → type the password. Check "Mark private key as exportable" if you want to be able to export it again.
Keychain Access → "Login" Keychain → "My Certificates" category → File → Import Items → choose the file and enter the password.
Copy the file to your phone. Settings → Security → Credential Storage → "Install from phone storage". Choose the file, type the password, and give it a name without spaces. In "Use", select "VPN and apps".
Send the file to a Mail account on your iPhone or save it to iCloud. Tap on the file and follow the installation wizard.
Where to save the backup
A backup that is on the same PC doesn't protect you if the PC fails. Save it outside.
- USB drive, stored in a safe place separate from your computer.
- Encrypted storage or a password manager that supports file attachments.
- Two backups in different locations, in case one fails.
Save the password for the file separately, in your password manager. And protect that account with a second factor: you have the guide in what is 2FA and how to protect your accounts with YubiKey.
If you want to carry the certificate on a key
With the backup made, you can import the certificate to a physical key and use it on any computer, with its PIN.
Always do this after the backup. According to ChipNet's manual, only the public part of the certificate can be exported from the key. Your .pfx or .p12 file is the only complete copy.
The steps to import it are in ChipNet FIDO2: what it is, how it works, and how to use your digital certificate.
ChipNet FIDO2 NFC Plus
FIDO2, U2F, NFC, OTP, and PIV (X.509 digital certificate). According to ChipNet, it works without drivers on Windows and Mac. The Basic does not support digital certificate.
NFC: Yes
What you should not do
- Give the backup or its password to anyone. The FNMT reminds you that the certificate is the responsibility of its holder.
- Save the file without a password or leave it in a shared folder.
- Keep the backup only on the computer you want to protect.
- Forget to renew the backup: when you renew your certificate, export the new one with its private key.
Frequently Asked Questions
What is the difference between .pfx, .p12, and .cer?
.pfx and .p12 are the backup with private key: they are used to restore the certificate. .cer and .crt only contain the public part and do not work as a backup.
What do I do if I forget the password for the file?
A protected file cannot be opened without its password. If you don't remember it and don't have another copy, you will have to request a new certificate from the FNMT.
Can I export the certificate from my DNIe or a card?
No. The FNMT indicates that a certificate obtained on a card cannot be exported with its private key.
Can I install the same backup on multiple devices?
Yes, as long as you have the file and its password. The more devices that have it, the more careful you need to be about where you store it.
Make it today, while you still can
A backup with private key, a strong password, and two storage locations solve most problems.
On Android, the backup must be made when downloading the certificate. On a card or key, before moving it.
Official sources: FNMT, frequently asked questions about export and import and FNMT, mobile device.
As an Amazon Associate, I earn from qualifying purchases.
