Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I used the makecert tool to create:

  1. self-signed certificate
  2. client certificate

These are the commands I used:

makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed certificate**

makecert -sk localhost -iv MatthewCA.pvk -n "CN=localhost" -ic MatthewCA.cer localhost.cer -sr localmachine -ss my -sky exchange -pe -b 01/01/2013 -e 01/01/2020 **for client certificate**

The two commands generated the following files:

  1. MatthewCA.cer
  2. MatthewCA.pvk
  3. localhost.cer

I then installed MatthewCA.cer in the Trusted Root Authorities section inmmc.

The localhost.cer was installed in the Personal section in mmc.

When I view the certificate of localhost.cer from mmc, it says:

You have a private key that corresponds to this certificate.

Does this mean that the certificate contains the private key? If I send the localhost.cer to someone else, can they extract the private key? If yes, how can I separate the private key from the certificate?

share|improve this question
Certificate holds only the public key. – Shurmajee Apr 27 '13 at 16:31
up vote 5 down vote accepted

When the machine says that "you have the private key corresponding to this certificate", then this means that you have the private key which corresponds to the certificate, not that the certificate itself contains the private key.

Asymmetric keys come in pairs: the public key and the private key. They are mathematically linked to each other, but rebuilding the private key from the public key is considered unfeasible (way too expensive with existing technology). This is why the public key can be made public: this does not reveal the private key (which is kept private).

The certificate contains only the public key. The certificate is inherently public and can be shown to the whole World. When the certificate is used in SSL, it is indeed sent, as part of the protocol, to the peer. The private key, of course, remains private. In your case, the private key was generated within the entrails of Windows and it stays there. The localhost.cer file contains only the certificate.

(Unfortunately, some documentations designate by "certificate" the union of the certificate itself and the private key; this abuse of terminology is a great source of confusion. In the Windows world, when a certificate and a private key travel together as a file, the file follows the PKCS#12 format, also known as "PFX".)

share|improve this answer
Thank you very much Thomas :) Thank you for taking the time to answer my question in detail :) – Matthew Apr 27 '13 at 16:38
With regards to the .pvk file, in case it gets stolen, can they get the private key from it? If I remember correctly, I had to enter a password when creating the .pvk file. I assume that one has to enter the same password in order to get the private key from it. Is that correct? – Matthew Apr 27 '13 at 16:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.