If I protect my private key with a passphrase, then it will be encrypted
Where is the symmetric key stored for it ? Is it somehow in the certificate itself? What if I have specified that it's not exportable and passphrase protected, if someone gains access to my OS and uses mimikatz to export it will she/he be able to decrypt it (assuming the passphrase was as easy as Test123) or will it fail because the symmetric key is tied to the OS and not the certificate itself?